Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:Setup.exe
Analysis ID:1546037
MD5:c306c6af9bd1955956f52acc1c9327ea
SHA1:3b3ed814ac41a710212cc83d92fde56a38b42b17
SHA256:9c7c1345990163c48c6f4801e26b12390c498395bf280a79ecf6aee816eefb49
Infos:

Detection

Score:51
Range:0 - 100
Whitelisted:false
Confidence:100%

Compliance

Score:34
Range:0 - 100

Signatures

Multi AV Scanner detection for dropped file
Creates multiple autostart registry keys
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Setup.exe (PID: 7388 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: C306C6AF9BD1955956F52ACC1C9327EA)
    • chrome.exe (PID: 7532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241031070029.271&_fcid=1730271248380473 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 4228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
    • nsq4808.tmp (PID: 3180 cmdline: "C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force MD5: 84EE733F8014D22DAD2DFEF725489980)
      • PcAppStore.exe (PID: 6520 cmdline: "C:\Users\user\PCAppStore\PcAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
          • PcAppStore.exe (PID: 5348 cmdline: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default MD5: 4B88D8ADA8D22622C30D581FC38EAA52)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 2672 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 2656 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5100 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5676 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 4948 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5964 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5936 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5592 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 3744 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 6016 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 3336 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5516 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5660 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5012 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 2368 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 1516 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 560 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 4592 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 3132 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 3128 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 2720 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 4484 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 6036 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 3260 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 2472 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 1312 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 5852 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WCKsatFYtLNCcBGzYutkrweBluUg.exe (PID: 4812 cmdline: "C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • Watchdog.exe (PID: 6648 cmdline: "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092c MD5: 11F3801CB9FF046D6075F681971C4EB8)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\PCAppStore\PCAppStore.exe" /init default, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\nsq4808.tmp, ProcessId: 3180, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PCAppStore

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpReversingLabs: Detection: 29%
Machine Learning detection for sample
Source: Setup.exeJoe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeEXE: C:\Users\user\PCAppStore\download\ZoomInstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&_winver=19045&version=fa.1092cHTTP Parser: No favicon
Source: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&_winver=19045&version=fa.1092cHTTP Parser: No favicon

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\Uninstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\Watchdog.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeEXE: C:\Users\user\PCAppStore\download\ZoomInstaller.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\AutoUpdater.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpEXE: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to behavior
Uses 32bit PE files
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Creates license or readme file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior
PE / OLE file has a valid certificate
Source: Setup.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.00000000027E4000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3061715229.00007FF75C49A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000000.2366649249.00007FF75C49A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000000E.00000002.3046497436.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000010.00000000.2449220299.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000011.00000002.3047062520.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000012.00000002.3041072285.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000013.00000002.3028041615.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000014.00000002.3042638220.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000015.00000000.2471622186.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000016.00000000.2475220946.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000017.00000000.2480749861.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000018.00000000.2485165462.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001A.00000000.2493935998.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001B.00000002.3034033202.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001C.00000002.3047804990.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001D.00000000.2500606041.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001F.00000000.2504050842.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000020.00000002.3040637974.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000021.00000002.3027462286.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000022.00000002.3028005009.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000023.00000000.2511109967.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000024.00000002.3051559338.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000025.00000000.2517940833.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000026.00000002.3041627451.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000027.00000000.2523509945.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000028.00000000.2524807272.0000000000C6E000.00000002.00000001.01000000.0
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2499837866.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506777440.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF71ADE75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF71ADE76A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4816E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF75C4816E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C481754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF75C481754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C490330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF75C490330
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 170.114.52.2 170.114.52.2
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC7CB80 GetTickCount64,Sleep,GetTickCount,Sleep,URLDownloadToFileW,Sleep,DeleteFileW,10_2_00007FF71AC7CB80
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chromecache_321.3.drString found in binary or memory: Math.round(q);t["gtm.videoElapsedTime"]=Math.round(f);t["gtm.videoPercent"]=r;t["gtm.videoVisible"]=u;return t},rk:function(){e=pb()},zd:function(){d()}}};var Yb=ka(["data-gtm-yt-inspected-"]),nD=["www.youtube.com","www.youtube-nocookie.com"],oD,pD=!1; equals www.youtube.com (Youtube)
Source: chromecache_321.3.drString found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=UA(a,c,e);S(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return S(122),!0;if(d&&f){for(var m=Ab(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},XA=function(){var a=[],b=function(c){return db(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chromecache_321.3.drString found in binary or memory: if(!(e||f||g||k.length||m.length))return;var p={Ah:e,yh:f,zh:g,ii:k,ji:m,Qe:n,Ib:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};G(function(){for(var u=E.getElementsByTagName("script"),v=u.length,t=0;t<v;t++){var w=u[t].getAttribute("src");if(yD(w,"iframe_api")||yD(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!pD&&wD(x[A],p.Qe))return oc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_321.3.drString found in binary or memory: var AC=function(a,b,c,d,e){var f=rA("fsl",c?"nv.mwt":"mwt",0),g;g=c?rA("fsl","nv.ids",[]):rA("fsl","ids",[]);if(!g.length)return!0;var k=wA(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);S(121);if(m==="https://www.facebook.com/tr/")return S(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!dz(k,fz(b, equals www.facebook.com (Facebook)
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136P
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2517te
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2970encodin
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4384e
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4551e2
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/62488
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279d
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000002.3395481405.00001F500041C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000002.3395481405.00001F500041C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761A
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000001.00000002.3396343213.00001F50004F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjAt
Source: chrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pa
Source: chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx352.0/
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemjh
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkihi
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagna
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobagln
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojlnjndmcbiieeg
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.689539685.14/ob
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcocm
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpng
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgieaddgfe
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanleaf
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjd
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcecd
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcji
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaea
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnf
Source: chrome.exe, 00000001.00000002.3432681498.00001F5001540000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00
Source: chrome.exe, 00000001.00000002.3420894777.00001F5000CE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_
Source: chrome.exe, 00000001.00000002.3425707081.00001F5000FF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebnd
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookg
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojl
Source: chrome.exe, 00000001.00000002.3390185653.00001F500014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.689
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjk
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.23
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpim
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/k
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/go
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/nei
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbog
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.120
Source: chrome.exe, 00000001.00000002.3388689636.00001F500009E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://localhost:64111/browseore/api/api.php
Source: chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://localhost:64111/saveimgD93BF0&_fcid=1730271248380473&_winver=19045&version=fa.1092c
Source: Setup.exe, 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Setup.exe, 00000000.00000000.1750365336.000000000040A000.00000008.00000001.01000000.00000003.sdmp, nsq4808.tmp, 00000009.00000000.2016697958.000000000040A000.00000008.00000001.01000000.0000000F.sdmp, nsq4808.tmp, 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmp, nsq4808.tmp, 00000009.00000002.2496609049.0000000002F60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS0
Source: chrome.exe, 00000001.00000002.3420894777.00001F5000CE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000001.00000002.3419179801.00001F5000C40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3413538929.00001F5000994000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/a
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgy
Source: chrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thir
Source: chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppe
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnn
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompec
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhob
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojlnjndmcbi
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.689539685.1
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkk
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eei
Source: chrome.exe, 00000001.00000002.3419792507.00001F5000C70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgiead
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncan
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjd
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkj
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindgg
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhl
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkeh
Source: chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3388043152.00001F5000064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000001.00000002.3395481405.00001F500041C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000001.00000002.3388043152.00001F5000064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000001.00000002.3395481405.00001F500041C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comP
Source: chrome.exe, 00000001.00000002.3415622670.00001F5000A78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://alling.p
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://analytics.google.com/g/collect?v=2&tid=G-VFQWFX3X1C&gtm=45je4au0h2v898645365za200zb910325665
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.3395815212.00001F5000490000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000001.00000002.3395815212.00001F5000490000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000001.00000002.3413538929.00001F5000994000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000001.00000002.3413078495.00001F500097C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416875858.00001F5000B28000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000002.3416875858.00001F5000B28000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en106243
Source: chrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstoreP
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/(TrustTokenOperationsRequiringOriginTrial#all-operat
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000001.00000002.3394717986.00001F5000390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3398039226.00001F5000618000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000001.00000002.3396343213.00001F50004F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: chrome.exe, 00000001.00000002.3425600382.00001F5000FE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoog
Source: chrome.exe, 00000001.00000002.3393937604.00001F5000300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.c
Source: chrome.exe, 00000001.00000002.3427578825.00001F5001114000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3415276757.00001F5000A48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:
Source: chrome.exe, 00000001.00000002.3228261023.000001FDACA6D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3418519744.00001F5000BE0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3405421194.00001F5000748000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
Source: chrome.exe, 00000001.00000002.3418519744.00001F5000BE0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
Source: chrome.exe, 00000001.00000002.3228261023.000001FDACA6D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1d
Source: chrome.exe, 00000001.00000002.3393937604.00001F5000300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1C1ONGR_enUS1134
Source: chrome.exe, 00000001.00000002.3398368580.00001F5000658000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3405523488.00001F500075A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393937604.00001F5000300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Security-Policy:
Source: chrome.exe, 00000001.00000002.3398368580.00001F5000658000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3405523488.00001F500075A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393937604.00001F5000300000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1Content-Type:
Source: chrome.exe, 00000001.00000002.3405523488.00001F500075A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/download-dt/1d
Source: chrome.exe, 00000001.00000002.3415276757.00001F5000A48000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:57:0
Source: chrome.exe, 00000001.00000002.3382959223.000001FDB05ED000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0Cross-Origin-Opener-Policy-Report-Only:
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
Source: Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/
Source: Setup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/MINGPROFILE=JO
Source: Setup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_insta
Source: Setup.exe, 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=ersion=fa.1092c&src=pc
Source: Setup.exe, 00000000.00000002.2032146838.0000000000819000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026333149.0000000000819000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: Setup.exe, 00000000.00000002.2032146838.0000000000819000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026333149.0000000000819000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092cPa
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTgyNjA
Source: chrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_p
Source: chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppeemj
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcnnkih
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompecagn
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobagl
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojlnjndmcbiiee
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.689539685.14/o
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkcoc
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpn
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgieaddgf
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanlea
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkj
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkjcec
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcj
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaae
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbn
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3432681498.00001F5001540000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/O
Source: chrome.exe, 00000001.00000002.3432921226.00001F5001548000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430067128.00001F5001388000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3433944483.00001F50015B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3432681498.00001F5001540000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/
Source: chrome.exe, 00000001.00000002.3433944483.00001F50015B0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/ore/c
Source: chrome.exe, 00000001.00000002.3433434563.00001F5001570000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doubleclick.net/t/
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3394717986.00001F5000390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3397468169.00001F50005C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.3397468169.00001F50005C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64
Source: chrome.exe, 00000001.00000002.3425707081.00001F5000FF0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.cr
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebn
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflook
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efnioj
Source: chrome.exe, 00000001.00000002.3390185653.00001F500014C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.68
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmj
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.2
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpi
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.130
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/g
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/ne
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbo
Source: chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.12
Source: chrome.exe, 00000001.00000002.3423426023.00001F5000EB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com
Source: chrome.exe, 00000001.00000002.3400374582.00001F5000721000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3423426023.00001F5000EB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://fonts.gstatic.com/
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000001.00000002.3387084981.00001F5000058000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436136&cv=
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436188&cv=
Source: chrome.exe, 00000001.00000002.3427578825.00001F5001114000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436528&cv=
Source: chrome.exe, 00000001.00000002.3433834662.00001F50015A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3429277393.00001F50012E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3432208048.00001F500151C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3429549881.00001F5001310000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3433834662.00001F50015A0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/=
Source: chrome.exe, 00000001.00000002.3429277393.00001F50012E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/cy
Source: chrome.exe, 00000001.00000002.3429277393.00001F50012E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/ithmZP
Source: chrome.exe, 00000001.00000002.3429549881.00001F5001310000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googletagmanager.com/y
Source: chrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000002.3424438401.00001F5000F50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000002.3424438401.00001F5000F50000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000002.3418824062.00001F5000C0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboard#exps-registration-success-page-urls
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiment/2/springboardPi
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000002.3232110268.000001FDACBC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://lens.google.com/v3/upload#companion-iph-blocklisted-page-urls
Source: chrome.exe, 00000001.00000002.3394177731.00001F500032C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3394717986.00001F5000390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3418408774.00001F5000BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418519744.00001F5000BE0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000002.3418408774.00001F5000BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000002.3418408774.00001F5000BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.3418408774.00001F5000BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000002.3418408774.00001F5000BD4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417767177.00001F5000B7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416025025.00001F5000AC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3392253047.00001F500027C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.st
Source: chrome.exe, 00000001.00000002.3416025025.00001F5000AC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.stD
Source: chrome.exe, 00000001.00000002.3419584106.00001F5000C68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3424735946.00001F5000F7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3414662646.00001F5000A18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3395337779.00001F500040C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F500073A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3423200308.00001F5000E9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F5000738000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3420390373.00001F5000CA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store
Source: Setup.exe, 00000000.00000002.2032146838.0000000000854000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3387084981.00001F5000058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3390738827.00001F500015C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3425402037.00001F5000FD2000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3343345564.000001FDAEFA3000.00000002.00000001.00040000.0000001C.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3397037448.00001F5000588000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417473523.00001F5000B73000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3423787216.00001F5000ED0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3123419597.00000067733FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3433944483.00001F50015B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3435341636.00001F50018A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3228561196.000001FDACAED000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3426073550.00001F5001030000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3425864176.00001F5001018000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F500073A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3431963485.00001F50014F8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/)
Source: chrome.exe, 00000001.00000002.3343345564.000001FDAEFA3000.00000002.00000001.00040000.0000001C.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store//
Source: chrome.exe, 00000001.00000002.3414511685.00001F5000A0C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/71248380473
Source: chrome.exe, 00000001.00000002.3427363516.00001F50010D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installin
Source: chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412902176.00001F500096C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/?p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=17302712483
Source: Setup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3427578825.00001F5001114000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/P
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/a=2592000Connection:
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3228261023.000001FDACA6D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3433834662.00001F50015A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3433434563.00001F5001570000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416556071.00001F5000B00000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3426739820.00001F500108C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3395699523.00001F5000478000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3425600382.00001F5000FE0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/api/api.php
Source: Setup.exe, 00000000.00000003.2026333149.00000000007E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&ve
Source: nsq4808.tmp, 00000009.00000002.2495673742.000000000081E000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2498335046.0000000003881000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&version=fa.1092c&src=pcap
Source: Setup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495312828.00000000007BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=&winver=
Source: chrome.exe, 00000001.00000002.3165367912.000001FDA8BD0000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3385426188.00000A50002A4000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3414511685.00001F5000A0C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3400248674.00001F500070C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3419792507.00001F5000C70000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa
Source: chrome.exe, 00000001.00000002.3426073550.00001F5001030000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico
Source: chrome.exe, 00000001.00000002.3400248674.00001F500070C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.ico5BqP
Source: chrome.exe, 00000001.00000002.3429679727.00001F5001328000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icoN-
Source: chrome.exe, 00000001.00000002.3432102343.00001F5001508000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/appstore/img/favicon.icopH
Source: chrome.exe, 00000001.00000002.3411946572.00001F50008A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/lpd_installin
Source: chrome.exe, 00000001.00000002.3426073550.00001F5001030000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/lp/lpd_installing_r2/src/lpd_installing_r2.min.js?nocache=1709636059406
Source: Setup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p
Source: Setup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p.store/download.php?&src=mini_installer&file=1&mini_ver=fa.1092c
Source: chrome.exe, 00000001.00000002.3425864176.00001F5001018000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/p=lpd_installing_r2&guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=173027124838
Source: Setup.exe, 00000000.00000002.2032678588.0000000002A84000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.1784098836.0000000002A85000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2493164662.0000000000822000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2493164662.0000000000808000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2346943114.0000000003865000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2346943114.0000000003867000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2346943114.0000000003889000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495673742.0000000000822000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2498335046.0000000003850000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495673742.0000000000808000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3183095672.0000027498DD0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3183095672.0000027498E46000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3134501078.0000027498709000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3134501078.00000274986A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&version=fa.1092c&evt_src=fa_
Source: nsq4808.tmp, 00000009.00000002.2495673742.000000000081E000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2493164662.0000000000808000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2498335046.0000000003881000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2498335046.0000000003867000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495673742.0000000000808000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixel.gif?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&version=fa.1092c&inst_parent
Source: chrome.exe, 00000001.00000002.3431543283.00001F5001458000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430661494.00001F50013B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430261305.00001F50013AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.php
Source: chrome.exe, 00000001.00000002.3430661494.00001F50013B8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpP
Source: chrome.exe, 00000001.00000002.3431543283.00001F5001458000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/pixelgif.phpm
Source: Setup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_min
Source: chrome.exe, 00000001.00000002.3431963485.00001F50014F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/rP
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/src/main.js
Source: Setup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495312828.00000000007BD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store/tos.html?guid=
Source: chrome.exe, 00000001.00000002.3419584106.00001F5000C68000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store1
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store:443
Source: chrome.exe, 00000001.00000002.3414662646.00001F5000A18000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000002.3395337779.00001F500040C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeAccess-Coro
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://pcapp.storeDate:
Source: chrome.exe, 00000001.00000002.3377799672.000001FDAF237000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeH
Source: chrome.exe, 00000001.00000002.3414943618.00001F5000A30000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storeHX
Source: chrome.exe, 00000001.00000002.3428110425.00001F500114D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.store_default
Source: chrome.exe, 00000001.00000002.3423324171.00001F5000EAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default
Source: chrome.exe, 00000001.00000002.3423324171.00001F5000EAC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://pcapp.storewww.googletagmanager.com_default/
Source: chrome.exe, 00000001.00000002.3389250415.00001F50000B4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win6
Source: chrome.exe, 00000001.00000002.3419179801.00001F5000C40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://redirector.gvt1.com/edgedl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.c
Source: chrome.exe, 00000001.00000002.3421736405.00001F5000D77000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3398368580.00001F5000662000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
Source: chrome.exe, 00000001.00000002.3388043152.00001F5000064000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000001.00000002.3388689636.00001F5000088000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmp, chromecache_321.3.drString found in binary or memory: https://td.doubleclick.net
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bjs
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/bts
Source: chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3228561196.000001FDACAE7000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=186695171.1730372436&gtm=45je4au0h2v8986
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B73000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F5000738000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416025025.00001F5000AC0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730372436136&cv=11&fst=1730372436136&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3417473523.00001F5000B73000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730372436188&cv=11&fst=1730372436188&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/rul/858128210?random=1730372436528&cv=11&fst=1730372436528&fmt=3&bg=ff
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net/td/update?ig_name=4s2146701656.1730372436
Source: chrome.exe, 00000001.00000002.3428110425.00001F500114D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s2146701656.1730372436
Source: chrome.exe, 00000001.00000002.3428110425.00001F500114D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.net4s2146701656.1730372436/
Source: chrome.exe, 00000001.00000002.3420390373.00001F5000CA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://td.doubleclick.neter.comccoofpliimaahmaaome
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=156786411258
Source: chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928
Source: chrome.exe, 00000001.00000002.3415622670.00001F5000A78000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928&cr_id=688917203998&cv_id=0&format=$
Source: chrome.exe, 00000001.00000002.3397468169.00001F50005C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/servic
Source: chrome.exe, 00000001.00000003.2451173224.00001F5000340000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.2451173224.00001F5000343000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/service/update2/json?cup2key=13:yTNt8Zkqf3Dd7IWJFICM26lL3Htbq-gOFv5JZd
Source: chrome.exe, 00000001.00000002.3397468169.00001F50005C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://update.googleapis.com/servicup
Source: chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000001.00000002.3398039226.00001F5000618000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjhkYWYwZDctOTExOS00MGQ5LTg
Source: chrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_thi
Source: chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmpp
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acaldksiunzh56452py2db5mnbpa_120.0.6050.0/jamhcn
Source: chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompe
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckho
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/aclacns2lwpknygjwzhz5vqbtzhq_1118/efniojlnjndmcb
Source: chrome.exe, 00000001.00000002.3391112532.00001F500018C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/aclz7ibkvp257t2vgob3ecc555sa_20241018.689539685.
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnk
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/ee
Source: chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgiea
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocnca
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabj
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgk
Source: chrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindg
Source: chrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkh
Source: chrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/dl/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkke
Source: chrome.exe, 00000001.00000002.3396204614.00001F50004E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416720767.00001F5000B14000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000002.3394717986.00001F5000390000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000001.00000002.3382959223.000001FDB05ED000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000001.00000002.3391938485.00001F500020C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000001.00000002.3377799672.000001FDAF237000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3414943618.00001F5000A30000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmp, chromecache_321.3.drString found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000002.3419584106.00001F5000C68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430661494.00001F50013B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3428110425.00001F500114D000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3432102343.00001F5001508000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430261305.00001F50013AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/
Source: chrome.exe, 00000001.00000002.3430261305.00001F50013AC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/P
Source: chrome.exe, 00000001.00000002.3423787216.00001F5000ED0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=AW-858128210
Source: chrome.exe, 00000001.00000002.3423787216.00001F5000ED0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
Source: chrome.exe, 00000001.00000003.2549857333.00001F5001A28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
Source: chrome.exe, 00000001.00000002.3432102343.00001F5001508000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/pH
Source: chrome.exe, 00000001.00000002.3405421194.00001F5000748000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3391182070.00001F5000194000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3424343152.00001F5000F38000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3419179801.00001F5000C40000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3427578825.00001F5001114000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
Source: chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeH
Source: chrome.exe, 00000001.00000002.3390738827.00001F500015C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3391182070.00001F5000194000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeHX
Source: chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storepp
Source: chrome.exe, 00000001.00000002.3427578825.00001F5001114000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.storeto
Source: chrome.exe, 00000001.00000002.3427363516.00001F50010D4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcap
Source: chrome.exe, 00000001.00000002.3283427795.000001FDAEB17000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.comH
Source: chrome.exe, 00000001.00000002.3424735946.00001F5000F7C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.comHX
Source: chrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3395919558.00001F50004B0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3393052150.00001F50002D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_004056DE
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindows user hook set: 0 mouse low level C:\Users\user\PCAppStore\PcAppStore.exeJump to behavior
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040755C0_2_0040755C
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406D850_2_00406D85
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_00406D5F9_2_00406D5F
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE3127410_2_00007FF71AE31274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC695B010_2_00007FF71AC695B0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0D98410_2_00007FF71AE0D984
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE21A5C10_2_00007FF71AE21A5C
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE200EC10_2_00007FF71AE200EC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0DD8810_2_00007FF71AE0DD88
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE213DC10_2_00007FF71AE213DC
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0B47810_2_00007FF71AE0B478
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0B27410_2_00007FF71AE0B274
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE1556010_2_00007FF71AE15560
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE76A810_2_00007FF71ADE76A8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE30BD810_2_00007FF71AE30BD8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE22B9410_2_00007FF71AE22B94
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0AC5810_2_00007FF71AE0AC58
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0AA5410_2_00007FF71AE0AA54
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE2F00810_2_00007FF71AE2F008
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE20F4810_2_00007FF71AE20F48
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC40F2010_2_00007FF71AC40F20
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0B06810_2_00007FF71AE0B068
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0AE6410_2_00007FF71AE0AE64
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0C3D810_2_00007FF71AE0C3D8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE0C75C10_2_00007FF71AE0C75C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48175411_2_00007FF75C481754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C47ED5011_2_00007FF75C47ED50
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48DDDC11_2_00007FF75C48DDDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C488EDC11_2_00007FF75C488EDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C489F2011_2_00007FF75C489F20
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48C7C411_2_00007FF75C48C7C4
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C49285C11_2_00007FF75C49285C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4890E811_2_00007FF75C4890E8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48D94811_2_00007FF75C48D948
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C496AB811_2_00007FF75C496AB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C49033011_2_00007FF75C490330
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4923C011_2_00007FF75C4923C0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48E45C11_2_00007FF75C48E45C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C488CD011_2_00007FF75C488CD0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF71ABFFCC0 appears 57 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF71ABF11A0 appears 403 times
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: String function: 00007FF71ABF0F30 appears 102 times
Source: NW_store.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: nw.dll.9.drStatic PE information: Number of sections : 15 > 10
Source: vk_swiftshader.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: ffmpeg.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: vulkan-1.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: libEGL.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: node.dll.9.drStatic PE information: Number of sections : 11 > 10
Source: nw_elf.dll.9.drStatic PE information: Number of sections : 14 > 10
Source: libGLESv2.dll.9.drStatic PE information: Number of sections : 12 > 10
Source: notification_helper.exe.9.drStatic PE information: Number of sections : 13 > 10
Source: Setup.exe, 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameinetc.dllF vs Setup.exe
Source: Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal51.spyw.evad.winEXE@35/289@0/30
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ABF8790 GetLastError,FormatMessageW,10_2_00007FF71ABF8790
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,9_2_00403640
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_0040498A
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C47DBA0 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Concurrency::details::WorkQueue::IsStructuredEmpty,CloseHandle,Process32NextW,CloseHandle,11_2_00007FF75C47DBA0
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_004021AA CoCreateInstance,0_2_004021AA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC91860 FindResourceExW,LoadResource,LockResource,SizeofResource,GlobalAlloc,GlobalLock,GlobalUnlock,CreateStreamOnHGlobal,GetLastError,10_2_00007FF71AC91860
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStoreJump to behavior
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277E.tmpJump to behavior
Source: Setup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT sql FROM%d UNION ALL SELECT shell_add_schema(sql,mainNULL,name) AS sql, type, tbl_name, name, rowid, AS snum, AS sname FROM .sqlite_schema UNION ALL SELECT shell_module_schema(name), 'table', name, name, name, 9e+99, 'main' FROM pragma_module_list) WHERE %Qlower(printf('%s.%s',sname,tbl_name))lower(tbl_name) GLOB LIKE ESCAPE '\' AND name NOT LIKE 'sqlite_%%' AND sql IS NOT NULL ORDER BY snum, rowidSQL: %s;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');%s
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT max(length(key)) FROM temp.sqlite_parameters;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: CREATE TABLE ColNames( cpos INTEGER PRIMARY KEY, name TEXT, nlen INT, chop INT, reps INT, suff TEXT);CREATE VIEW RepeatedNames AS SELECT DISTINCT t.name FROM ColNames t WHERE t.name COLLATE NOCASE IN ( SELECT o.name FROM ColNames o WHERE o.cpos<>t.cpos);
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT type,name,tbl_name,sql FROM sqlite_schema ORDER BY name;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT key, quote(value) FROM temp.sqlite_parameters;
Source: chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO selftest(tno,op,cmd,ans) SELECT rowid*10,op,cmd,ans FROM [_shell$self];
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;Warning: cannot step "%s" backwardsSELECT name, sql FROM sqlite_schema WHERE %sError: (%d) %s on [%s]
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO sqlite_schema(type,name,tbl_name,rootpage,sql)VALUES('table','%q','%q',0,'%q');
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT * FROM "%w" ORDER BY rowid DESC;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT tbl,idx,stat FROM sqlite_stat1 ORDER BY tbl,idx;
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'EXPLAIN QUERY PLAN SELECT 1 FROM ' || quote(s.name) || ' WHERE ' || group_concat(quote(s.name) || '.' || quote(f.[from]) || '=?' || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]),' AND '), 'SEARCH ' || s.name || ' USING COVERING INDEX*(' || group_concat('*=?', ' AND ') || ')', s.name || '(' || group_concat(f.[from], ', ') || ')', f.[table] || '(' || group_concat(COALESCE(f.[to], p.[name])) || ')', 'CREATE INDEX ' || quote(s.name ||'_'|| group_concat(f.[from], '_')) || ' ON ' || quote(s.name) || '(' || group_concat(quote(f.[from]) || fkey_collate_clause( f.[table], COALESCE(f.[to], p.[name]), s.name, f.[from]), ', ') || ');', f.[table] FROM sqlite_schema AS s, pragma_foreign_key_list(s.name) AS f LEFT JOIN pragma_table_info AS p ON (pk-1=seq AND p.arg=f.[table]) GROUP BY s.name, f.id ORDER BY (CASE WHEN ? THEN f.[table] ELSE s.name END)
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT 'CREATE TEMP' || substr(sql, 7) FROM sqlite_schema WHERE tbl_name = %Q AND type IN ('table', 'trigger') ORDER BY type;ALTER TABLE temp.%Q RENAME TO %QINSERT INTO %Q VALUES(, %s?)UPDATE %Q SET , %s%Q=?DELETE FROM %QSELECT type, name, sql, 1 FROM sqlite_schema WHERE type IN ('table','view') AND name NOT LIKE 'sqlite_%%' UNION ALL SELECT type, name, sql, 2 FROM sqlite_schema WHERE type = 'trigger' AND tbl_name IN(SELECT name FROM sqlite_schema WHERE type = 'view') ORDER BY 4, 1CREATE TABLE x(, %s%Q COLLATE %s)CREATE VIRTUAL TABLE %Q USING expert(%Q)SELECT max(i.seqno) FROM sqlite_schema AS s, pragma_index_list(s.name) AS l, pragma_index_info(l.name) AS i WHERE s.type = 'table', %sx.%Q IS rem(%d, x.%Q) COLLATE %s%s%dSELECT %s FROM %Q x ORDER BY %sSELECT %s FROM temp.t592690916721053953805701627921227776 x ORDER BY %s%d %dDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776CREATE TABLE temp.t592690916721053953805701627921227776 AS SELECT * FROM %QSELECT s.rowid, s.name, l.name FROM sqlite_schema AS s, pragma_index_list(s.name) AS l WHERE s.type = 'table'SELECT name, coll FROM pragma_index_xinfo(?) WHERE keyINSERT INTO sqlite_stat1 VALUES(?, ?, ?)ANALYZE; PRAGMA writable_schema=1remsampleDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776ANALYZE sqlite_schemaDROP TABLE IF EXISTS temp.t592690916721053953805701627921227776:memory::memory:SELECT sql FROM sqlite_schema WHERE name NOT LIKE 'sqlite_%%' AND sql NOT LIKE 'CREATE VIRTUAL %%'Cannot find a unique index name to propose. -- stat1: %s;%s%s
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: INSERT OR IGNORE INTO "%s" VALUES(?,?);Error %d: %s on [%s]
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366350970.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506897341.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2500001259.00007FF71AE92000.00000008.00000001.01000000.00000016.sdmpBinary or memory string: SELECT name,seq FROM sqlite_sequence ORDER BY name;
Source: C:\Users\user\Desktop\Setup.exeFile read: C:\Users\user\Desktop\Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Setup.exe "C:\Users\user\Desktop\Setup.exe"
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241031070029.271&_fcid=1730271248380473
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsq4808.tmp "C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092c
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241031070029.271&_fcid=1730271248380473Jump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsq4808.tmp "C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /forceJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PcAppStore.exe" /init default Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess created: C:\Users\user\PCAppStore\Watchdog.exe "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092cJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\PCAppStore\PcAppStore.exe "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Windows\explorer.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: ieframe.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: mlang.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\Desktop\Setup.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiautomationcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: uiamanager.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.shell.servicehostbuilder.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: pcacli.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: apphelp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: windows.storage.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wldp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: uxtheme.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: wininet.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mswsock.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: winnsi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dnsapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: schannel.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ntasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: msasn1.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: dpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptsp.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: rsaenh.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: cryptbase.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: gpapi.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncrypt.dll
Source: C:\Users\user\PCAppStore\Watchdog.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\explorer.exeSection loaded: cdprt.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: provsvc.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: windows.internal.shell.broker.dll
Source: C:\Windows\explorer.exeSection loaded: capabilityaccessmanagerclient.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: urlmon.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iertutil.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: srvcli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: netutils.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: version.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wlanapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: winhttp.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: dwmapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wtsapi32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: secur32.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: profapi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: sspicli.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: amsi.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: userenv.dll
Source: C:\Users\user\PCAppStore\PcAppStore.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: uiautomationcore.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: cryptbase.dll
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeSection loaded: oleacc.dll
Source: C:\Users\user\Desktop\Setup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: PC App Store.lnk.9.drLNK file: ..\..\..\..\..\..\PCAppStore\PcAppStore.exe
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCAppStoreJump to behavior
Source: Setup.exeStatic PE information: certificate valid
Source: Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\Watchdog\x64\Release\Watchdog.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.00000000027E4000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3061715229.00007FF75C49A000.00000002.00000001.01000000.00000017.sdmp, Watchdog.exe, 0000000B.00000000.2366649249.00007FF75C49A000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb1 source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000000E.00000002.3046497436.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000010.00000000.2449220299.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000011.00000002.3047062520.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000012.00000002.3041072285.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000013.00000002.3028041615.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000014.00000002.3042638220.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000015.00000000.2471622186.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000016.00000000.2475220946.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000017.00000000.2480749861.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000018.00000000.2485165462.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001A.00000000.2493935998.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001B.00000002.3034033202.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001C.00000002.3047804990.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001D.00000000.2500606041.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 0000001F.00000000.2504050842.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000020.00000002.3040637974.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000021.00000002.3027462286.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000022.00000002.3028005009.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000023.00000000.2511109967.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000024.00000002.3051559338.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000025.00000000.2517940833.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000026.00000002.3041627451.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000027.00000000.2523509945.0000000000C6E000.00000002.00000001.01000000.0000001A.sdmp, WCKsatFYtLNCcBGzYutkrweBluUg.exe, 00000028.00000000.2524807272.0000000000C6E000.00000002.00000001.01000000.0
Source: Binary string: C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb source: Setup.exe, 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\engine\Release\PCAppStore.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000000.2499837866.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000001E.00000002.2506777440.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Build\Build_1092c_D20241025T171023\fa_rss\AppStoreUpdater\Release\auto_updater.pdb source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC4BFE0 atomic,RoGetActivationFactory,atomic,LoadLibraryW,GetProcAddress,RoGetActivationFactory,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF71AC4BFE0
Source: Setup.exeStatic PE information: real checksum: 0x3937f should be: 0x33c16
Source: NW_store.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x23ab08
Source: System.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: System.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x3d68
Source: vk_swiftshader.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x44caa7
Source: ffmpeg.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x1f8136
Source: nsJSON.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: NSISFastLib.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: vulkan-1.dll.9.drStatic PE information: real checksum: 0x0 should be: 0xe0b14
Source: libEGL.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7ddc6
Source: nsJSON.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x6718
Source: Math.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x155a8
Source: nw_elf.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x124d11
Source: NSISFastLib.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x30512
Source: inetc.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x13c41
Source: libGLESv2.dll.9.drStatic PE information: real checksum: 0x0 should be: 0x7b9652
Source: notification_helper.exe.9.drStatic PE information: real checksum: 0x0 should be: 0x11edb8
Source: nsDialogs.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x2f9b
Source: NW_store.exe.9.drStatic PE information: section name: .gxfg
Source: NW_store.exe.9.drStatic PE information: section name: .retplne
Source: NW_store.exe.9.drStatic PE information: section name: .voltbl
Source: NW_store.exe.9.drStatic PE information: section name: CPADinfo
Source: NW_store.exe.9.drStatic PE information: section name: _RDATA
Source: NW_store.exe.9.drStatic PE information: section name: malloc_h
Source: ffmpeg.dll.9.drStatic PE information: section name: .gxfg
Source: ffmpeg.dll.9.drStatic PE information: section name: .retplne
Source: ffmpeg.dll.9.drStatic PE information: section name: .voltbl
Source: ffmpeg.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: .gxfg
Source: libEGL.dll.9.drStatic PE information: section name: .retplne
Source: libEGL.dll.9.drStatic PE information: section name: .voltbl
Source: libEGL.dll.9.drStatic PE information: section name: _RDATA
Source: libEGL.dll.9.drStatic PE information: section name: malloc_h
Source: libGLESv2.dll.9.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.9.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.9.drStatic PE information: section name: .voltbl
Source: libGLESv2.dll.9.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.9.drStatic PE information: section name: malloc_h
Source: node.dll.9.drStatic PE information: section name: .gxfg
Source: node.dll.9.drStatic PE information: section name: .retplne
Source: node.dll.9.drStatic PE information: section name: .voltbl
Source: node.dll.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.9.drStatic PE information: section name: .retplne
Source: notification_helper.exe.9.drStatic PE information: section name: .voltbl
Source: notification_helper.exe.9.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.9.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.9.drStatic PE information: section name: malloc_h
Source: nw.dll.9.drStatic PE information: section name: .gxfg
Source: nw.dll.9.drStatic PE information: section name: .retplne
Source: nw.dll.9.drStatic PE information: section name: .rodata
Source: nw.dll.9.drStatic PE information: section name: .voltbl
Source: nw.dll.9.drStatic PE information: section name: CPADinfo
Source: nw.dll.9.drStatic PE information: section name: LZMADEC
Source: nw.dll.9.drStatic PE information: section name: _RDATA
Source: nw.dll.9.drStatic PE information: section name: malloc_h
Source: nw_elf.dll.9.drStatic PE information: section name: .crthunk
Source: nw_elf.dll.9.drStatic PE information: section name: .gxfg
Source: nw_elf.dll.9.drStatic PE information: section name: .retplne
Source: nw_elf.dll.9.drStatic PE information: section name: .voltbl
Source: nw_elf.dll.9.drStatic PE information: section name: CPADinfo
Source: nw_elf.dll.9.drStatic PE information: section name: _RDATA
Source: nw_elf.dll.9.drStatic PE information: section name: malloc_h
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .gxfg
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .retplne
Source: vk_swiftshader.dll.9.drStatic PE information: section name: .voltbl
Source: vk_swiftshader.dll.9.drStatic PE information: section name: _RDATA
Source: vulkan-1.dll.9.drStatic PE information: section name: .gxfg
Source: vulkan-1.dll.9.drStatic PE information: section name: .retplne
Source: vulkan-1.dll.9.drStatic PE information: section name: .voltbl
Source: vulkan-1.dll.9.drStatic PE information: section name: _RDATA
Source: ZoomInstaller.exe.10.drStatic PE information: section name: _RDATA
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC4F0B0 pushfq ; ret 10_2_00007FF71AC4F0B1
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile created: C:\Users\user\PCAppStore\download\ZoomInstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\System.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsq4808.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\Watchdog.exeJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeFile created: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\PcAppStore.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txtJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\PCAppStore\ReadMe.txtJump to behavior

Boot Survival

barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCAppStoreJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdaterJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WatchdogJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
Source: C:\Users\user\Desktop\Setup.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
Source: C:\Users\user\PCAppStore\Watchdog.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\Setup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Caption from Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Size from Win32_DiskDrive
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 627Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 784Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: threadDelayed 1377Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeWindow / User API: foregroundWindowGot 533Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\Uninstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\NW_store.exeJump to dropped file
Source: C:\Users\user\PCAppStore\PcAppStore.exeDropped PE file which has not been started: C:\Users\user\PCAppStore\download\ZoomInstaller.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\ffmpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsJSON.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\Setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\NSISFastLib.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\vulkan-1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\node.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\AutoUpdater.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\nw_elf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj906B.tmp\Math.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpDropped PE file which has not been started: C:\Users\user\PCAppStore\nwjs\libGLESv2.dllJump to dropped file
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6816Thread sleep count: 270 > 30
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6816Thread sleep time: -16200000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6676Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\PCAppStore\Watchdog.exe TID: 6816Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select ReleaseDate from Win32_BIOS
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select UUID from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Vendor from Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Version from Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\PCAppStore\PcAppStore.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select Name from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select MaxClockSpeed from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfCores from Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : Select NumberOfLogicalProcessors from Win32_Processor
Source: C:\Users\user\PCAppStore\PcAppStore.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\PCAppStore\Watchdog.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C49
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_00406873 FindFirstFileW,FindClose,0_2_00406873
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040290B FindFirstFileW,0_2_0040290B
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,9_2_00405D74
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_0040699E FindFirstFileW,FindClose,9_2_0040699E
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpCode function: 9_2_0040290B FindFirstFileW,9_2_0040290B
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE75F8 FindClose,FindFirstFileExW,GetLastError,GetCurrentDirectoryW,GetLastError,10_2_00007FF71ADE75F8
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE76A8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,10_2_00007FF71ADE76A8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4816E0 FindClose,FindFirstFileExW,GetLastError,11_2_00007FF75C4816E0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C481754 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,11_2_00007FF75C481754
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C490330 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,11_2_00007FF75C490330
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 300000
Source: C:\Users\user\PCAppStore\Watchdog.exeThread delayed: delay time: 60000
Source: explorer.exe, 0000000C.00000000.2395487561.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: chrome.exe, 00000001.00000002.3416025025.00001F5000AC0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware
Source: nsq4808.tmp, 00000009.00000003.2493164662.0000000000808000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495673742.0000000000808000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8
Source: chrome.exe, 00000001.00000002.3427056179.00001F50010B0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 0000000C.00000002.3035085879.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 0000000C.00000002.3070608492.0000000003758000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: PcAppStore.exe, 0000001E.00000002.2506009311.0000023DC2C60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: PcAppStore.exe, 0000000A.00000002.3134501078.0000027498670000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: PcAppStore.exe, 0000001E.00000003.2504655666.0000023DC2C92000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductHMFH4171434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.None+
Source: Setup.exe, 00000000.00000003.1759403368.0000000002A60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"Setup%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe","13":"WCKsatFYtLNCcBGzYutkrweBluUg%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe","25":"explorer%2Eexe","26":"fontdrvhost%2Eexe","27":"lsass%2Eexe","28":"services%2Eexe","29":"sihost%2Eexe","30":"smartscreen%2Eexe","31":"smss%2Eexe","32":"spoolsv%2Eexe","33":"sppsvc%2Eexe","34":"svchost%2Eexe","35":"upfc%2Eexe","36":"wininit%2Eexe","37":"winlogon%2Eexe"},"sys_lang":"en-GB","parent_proc":"explorer%2Eexe"}
Source: Setup.exe, 00000000.00000003.2027254429.0000000000846000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032678588.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032146838.0000000000846000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000003.2493164662.000000000084F000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495673742.000000000084F000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3088361173.0000027495EB7000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000002.3088361173.0000027495F5E000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3042232678.00000233BAA2C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000002.3042232678.00000233BA9B3000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2504090931.00000233BAA2C000.00000004.00000020.00020000.00000000.sdmp, Watchdog.exe, 0000000B.00000003.2504090931.00000233BA9C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: nsq4808.tmp, 00000009.00000002.2498335046.0000000003850000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware%2C+Inc%2E
Source: explorer.exe, 0000000C.00000002.3390909845.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Setup.exe, 00000000.00000003.1758536585.0000000000819000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"Setup%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe",
Source: chrome.exe, 00000001.00000002.3165367912.000001FDA8BE7000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000001E.00000002.2506009311.0000023DC2C60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Setup.exe, 00000000.00000003.1758122387.0000000000819000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device",
Source: Setup.exe, 00000000.00000002.2032678588.0000000002A60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,"cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"4
Source: explorer.exe, 0000000C.00000002.3385003856.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 0000000C.00000000.2376803618.00000000078A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 0000000C.00000002.3177256403.00000000079FB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}'
Source: explorer.exe, 0000000C.00000000.2395487561.00000000098A8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000002.3390909845.0000000009977000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
Source: Setup.exe, 00000000.00000003.1758536585.0000000000836000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry",
Source: tempPOSTData.9.drBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"SgrmBroker%2Eexe","7":"StartMenuExperienceHost%2Eexe","8":"System","9":"SystemSettings%2Eexe","10":"TextInputHost%2Eexe","11":"UserOOBEBroker%2Eexe","12":"WCKsatFYtLNCcBGzYutkrweBluUg%2Eexe","13":"WinStore%2EApp%2Eexe","14":"WmiPrvSE%2Eexe","15":"%5BSystem+Process%5D","16":"audiodg%2Eexe","17":"chrome%2Eexe","18":"conhost%2Eexe","19":"csrss%2Eexe","20":"ctfmon%2Eexe","21":"dasHost%2Eexe","22":"dllhost%2Eexe","23":"dwm%2Eexe","24":"explorer%2Eexe","25":"fontdrvhost%2Eexe","26":"lsass%2Eexe","27":"nsq4808%2Etmp","28":"services%2Eexe","29":"sihost%2Eexe","30":"smartscreen%2Eexe","31":"smss%2Eexe","32":"spoolsv%2Eexe","33":"svchost%2Eexe","34":"wininit%2Eexe","35":"winlogon%2Eexe"}}
Source: explorer.exe, 0000000C.00000002.3177256403.00000000078AD000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTTAVMWare
Source: Setup.exe, 00000000.00000003.1759238980.0000000000819000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stem_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"Adobe+Acrobat+%2864-bit%29","8":"Microsoft+Visual+C%2B%2B+2022+X64+Minimum+Runtime+-+14%2E36%2E32532","9":"Google+Chrome","10":"Microsoft+Edge","11":"Microsoft+Edge+Update","12":"Microsoft+Edge+WebView2+Runtime","13":"Java+Auto+Updater","14":"Java+8+Update+381","15":"Microsoft+Visual+C%2B%2B+2015-2022+Redistributable+%28x64%29+-+14%2E36%2E32532","16":"Office+16+Click-to-Run+Extensibility+Component"},"processes":{"0":"ApplicationFrameHost%2Eexe","1":"Memory+Compression","2":"OfficeClickToRun%2Eexe","3":"Registry","4":"RuntimeBroker%2Eexe","5":"SearchApp%2Eexe","6":"Setup%2Eexe","7":"SgrmBroker%2Eexe","8":"StartMenuExperienceHost%2Eexe","9":"System","10":"SystemSettings%2Eexe","11":"TextInputHost%2Eexe","12":"UserOOBEBroker%2Eexe","13":"WCKsatFYtLNCcBGzYutkrweBluUg%2Eexe","14":"WinStore%2EApp%2Eexe","15":"WmiPrvSE%2Eexe","16":"%5BSystem+Process%5D","17":"audiodg%2Eexe","18":"backgroundTaskHost%2Eexe","19":"conhost%2Eexe","20":"csrss%2Eexe","21":"ctfmon%2Eexe","22":"dasHost%2Eexe","23":"dllhost%2Eexe","24":"dwm%2Eexe",
Source: explorer.exe, 0000000C.00000002.3385003856.0000000009815000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: PcAppStore.exe, 0000001E.00000002.2506009311.0000023DC2C60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductHMFH4171434D56-1548-ED3D-AEE6-C75AECD93BF0VMware, Inc.Noney*
Source: chrome.exe, 00000001.00000002.3424227462.00001F5000F24000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=504170ed-5f6f-4c43-96d5-6f9856e9395f
Source: explorer.exe, 0000000C.00000002.3177256403.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2376803618.0000000007A34000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 0000000C.00000002.3385003856.0000000009660000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 0000000C.00000002.3035085879.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Setup.exe, 00000000.00000003.1758122387.0000000000819000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: {"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{
Source: explorer.exe, 0000000C.00000002.3035085879.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\Setup.exeAPI call chain: ExitProcess graph end nodegraph_0-3503
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpAPI call chain: ExitProcess graph end nodegraph_9-3481
Source: C:\Users\user\Desktop\Setup.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE1254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,10_2_00007FF71ADE1254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE1254 __vcrt_InitializeCriticalSectionEx,GetLastError,IsDebuggerPresent,OutputDebugStringW,10_2_00007FF71ADE1254
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC4BFE0 atomic,RoGetActivationFactory,atomic,LoadLibraryW,GetProcAddress,RoGetActivationFactory,atomic,atomic,type_info::_name_internal_method,Concurrency::details::WorkQueue::IsStructuredEmpty,LoadLibraryW,Concurrency::details::_Scheduler::_Scheduler,GetProcAddress,atomic,10_2_00007FF71AC4BFE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC71E10 std::bad_exception::bad_exception,GetProcessHeap,HeapAlloc,std::bad_alloc::bad_alloc,10_2_00007FF71AC71E10
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE03990 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF71AE03990
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AE08CB8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF71AE08CB8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C48255C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,11_2_00007FF75C48255C
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C487EA8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF75C487EA8
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C482FDC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_00007FF75C482FDC
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4831C0 SetUnhandledExceptionFilter,11_2_00007FF75C4831C0

HIPS / PFW / Operating System Protection Evasion

barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtOpenKeyEx: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtReadVirtualMemory: Direct from: 0x76F02E8C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtQueryValueKey: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtAddAtomEx: Direct from: 0x76F0312C
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtSetInformationThread: Direct from: 0x76F02ECC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtTerminateThread: Direct from: 0x76F02FCC
Source: C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exeNtQueryInformationProcess: Direct from: 0x76F02C26
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71AC75130 keybd_event,keybd_event,10_2_00007FF71AC75130
Source: C:\Users\user\Desktop\Setup.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241031070029.271&_fcid=1730271248380473Jump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeProcess created: unknown unknownJump to behavior
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: C++/WinRT version:2.0.220110.5productr_binErreCode=%dproductcreate_shortcutshortcut_erroroid=%luSHGetFolderPath_error_code=%X&oid=%luQueryInterface_error_code=%X&oid=%luCoCreateInstance_error_code=%X&oid=%lu.lnknfinityan.lnkindsnanproductshortcut_delete_erroreC=%XnfinityanindsnanShell_TrayWnd0p+00p+0unknowninfnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)infnan(ind)nannan(snan)unknownLTRRTLLTRinfnan(ind)nannan(snan)infnan(ind)nannan(snan)type must be string, but is type must be number, but is type must be number, but is \\\HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_CURRENT_CONFIGCurrentBuildBuildNumberSOFTWARE\Microsoft\Windows NT\CurrentVersionSOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon%lu%02X\/Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSoftware\PCAppStoreAppParamdefaultauto_start_oncontextual_offersperiodical_offerspersonilized_notifications%us%5B%5D=\uparamsnametype must be string, but is paramsnameurloidentryAppfilePath0e+000e+00RoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll^(https?://(?:www.)?([^/]+))(/.*)?$.dllDllGetActivationFactoryURL format is not valid : %wsWinHTTP 1.0handle initialization failuretimeout init failurehandle connection failureGEThandle request creation failurehandle request or response failurefile creation failurequery data not availableurloidlastTimeoTypesessionIdtagretmessageRoGetActivationFactorycombase.dllCoIncrementMTAUsagecombase.dll.dllDllGetActivationFactoryiconnamepathoidanimationsoundmenu_storemenu_searchhttps://pcapp.storenamepathmicrosoftIdregpathkeydisplaycountblinkingnotificationIconrunParampathalt_linkmicrosoftIdregpathkeyidwinGetParamsaltActionaltActionParamsid
Source: chrome.exe, 00000001.00000002.3214554762.000001FDA95E0000.00000002.00000001.00040000.00000000.sdmp, PcAppStore.exe, PcAppStore.exe, 0000000A.00000003.2553967758.00000274986C9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2553824750.00000274986C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: productui_creation_failedcreation_error=%wsui_termination_errordirectory_switching_error.\nwjs\NW_store.exe.\ui\.ENDING_EVT_HANDLERWindows Default Lock ScreenLocalPCAppStore\productsystem_eventmsg=shutdownshutdownproductsystem_eventmsg=logofflogoff{"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}ClosingEventproducttaskbar_handler_erroreCode=%luShell_TrayWndStartTrayDummySearchControlTrayButton
Source: chrome.exe, 00000001.00000002.3214554762.000001FDA95E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3052396901.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2373272008.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: PcAppStore.exe, 0000000A.00000002.3088361173.0000027495EEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managernstaller
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: list too longStartMenuExperienceHost.exeShellExperienceHost.exeexplorer.exeSearchApp.exeSearchUI.exeSearchHost.exe{"app":{"menu_search":{"search_request":"", "page":"a", "top":%d,"left":%d,"bottom":%d,"right":%d},"show_window": "menu_search"}}{"app": {"hide_window": "menu_search"}}Shell_TrayWndStartTrayDummySearchControlTrayButton
Source: PcAppStore.exe, 0000000A.00000003.2553967758.00000274986C9000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2553824750.00000274986C0000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2554002235.00000274986CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnded.*
Source: explorer.exe, 0000000C.00000000.2372840527.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000002.3035085879.0000000001240000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 1Progman$
Source: chrome.exe, 00000001.00000002.3214554762.000001FDA95E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3052396901.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2373272008.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: chrome.exe, 00000001.00000002.3214554762.000001FDA95E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000002.3052396901.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2373272008.00000000018A0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: TTaskbarShell_TrayWnd{"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
Source: PcAppStore.exe, 0000000A.00000003.2553756411.00000274986F2000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2553719445.00000274986EB000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000003.2553891523.00000274986FB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndV
Source: PcAppStore.exe, 0000000A.00000002.3088361173.0000027495EEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managernstaller%p
Source: nsq4808.tmp, 00000009.00000002.2496609049.0000000002BD8000.00000004.00000020.00020000.00000000.sdmp, PcAppStore.exe, 0000000A.00000000.2366309517.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmp, PcAppStore.exe, 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: NWidgetShell_TrayWndTrayNotifyWnd+TrayButtonPNGArial++
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: 11_2_00007FF75C4967D0 cpuid 11_2_00007FF75C4967D0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,Concurrency::details::WorkQueue::IsStructuredEmpty,GetLocaleInfoEx,10_2_00007FF71AC67BE0
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: GetLocaleInfoEx,FormatMessageA,10_2_00007FF71ADE68B0
Source: C:\Users\user\PCAppStore\Watchdog.exeCode function: GetLocaleInfoEx,FormatMessageA,11_2_00007FF75C481448
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\PCAppStore\PcAppStore.exeCode function: 10_2_00007FF71ADE7B24 GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,10_2_00007FF71ADE7B24
Source: C:\Users\user\Desktop\Setup.exeCode function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,CoUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040352D
Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\Desktop\Setup.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\nsq4808.tmpWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select displayName from FirewallProduct

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\PCAppStore\PcAppStore.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_8_1_OBSOLETE,943,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_XP_VISTA_OBSOLETE,940,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_8_OBSOLETE,942,../../chrome/app/chromium_strings.grd
Source: sr.pak.info.9.drBinary or memory string: IDS_WIN_7_OBSOLETE,941,../../chrome/app/chromium_strings.grd

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts141
Windows Management Instrumentation		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Deobfuscate/Decode Files or Information		1
OS Credential Dumping		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Native API		1
DLL Search Order Hijacking		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Input Capture		2
File and Directory Discovery		Remote Desktop Protocol1
Data from Local System		1
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
Windows Service		1
DLL Search Order Hijacking		2
Obfuscated Files or Information		Security Account Manager156
System Information Discovery		SMB/Windows Admin Shares1
Input Capture		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron111
Registry Run Keys / Startup Folder		1
Access Token Manipulation		1
DLL Side-Loading		NTDS1
Query Registry		Distributed Component Object Model1
Clipboard Data		Protocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
Windows Service		1
DLL Search Order Hijacking		LSA Secrets261
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts12
Process Injection		1
Masquerading		Cached Domain Credentials141
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items111
Registry Run Keys / Startup Folder		141
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem1
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1546037 Sample: Setup.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 51 85 Machine Learning detection for sample 2->85 9 Setup.exe 2 42 2->9         started        process3 dnsIp4 81 159.223.126.41 CELANESE-US United States 9->81 83 195.181.170.18 CDN77GB United Kingdom 9->83 47 C:\Users\user\AppData\Local\...\nsq4808.tmp, PE32 9->47 dropped 49 C:\Users\user\AppData\Local\...\nsJSON.dll, PE32 9->49 dropped 51 C:\Users\user\AppData\Local\...\nsDialogs.dll, PE32 9->51 dropped 53 3 other files (none is malicious) 9->53 dropped 91 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 9->91 14 nsq4808.tmp 11 252 9->14         started        18 chrome.exe 1 9->18         started        file5 signatures6 process7 dnsIp8 55 C:\Users\user\PCAppStore\nwjs\vulkan-1.dll, PE32+ 14->55 dropped 57 C:\Users\user\...\vk_swiftshader.dll, PE32+ 14->57 dropped 59 C:\Users\user\PCAppStore\nwjs\nw_elf.dll, PE32+ 14->59 dropped 61 17 other files (11 malicious) 14->61 dropped 93 Multi AV Scanner detection for dropped file 14->93 95 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 14->95 97 Creates multiple autostart registry keys 14->97 21 PcAppStore.exe 2 4 14->21         started        26 Watchdog.exe 14->26         started        63 192.168.2.4 unknown unknown 18->63 65 239.255.255.250 unknown Reserved 18->65 28 chrome.exe 18->28         started        30 chrome.exe 18->30         started        32 chrome.exe 6 18->32         started        file9 signatures10 process11 dnsIp12 67 170.114.45.1 DORSEY-WHITNEYUS United States 21->67 69 170.114.52.2 DORSEY-WHITNEYUS United States 21->69 71 147.182.211.77 BV-PUBLIC-ASNUS United States 21->71 45 C:\Users\user\...\ZoomInstaller.exe, PE32+ 21->45 dropped 89 Tries to harvest and steal browser information (history, passwords, etc) 21->89 34 WCKsatFYtLNCcBGzYutkrweBluUg.exe 21->34 injected 37 explorer.exe 21->37 injected 39 WCKsatFYtLNCcBGzYutkrweBluUg.exe 21->39 injected 41 26 other processes 21->41 73 18.173.205.24 MIT-GATEWAYSUS United States 26->73 75 169.150.255.183 SPIRITTEL-ASUS United States 28->75 77 207.211.211.26 NAVISITE-EAST-2US United States 28->77 79 20 other IPs or domains 28->79 file13 signatures14 process15 signatures16 87 Found direct / indirect Syscall (likely to bypass EDR) 34->87 43 PcAppStore.exe 37->43         started        process17

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Setup.exe100%Joe Sandbox ML

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\nsi277F.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi277F.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj906B.tmp\Math.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj906B.tmp\NSISFastLib.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj906B.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj906B.tmp\nsJSON.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsq4808.tmp29%ReversingLabsWin32.Trojan.Generic
C:\Users\user\PCAppStore\AutoUpdater.exe5%ReversingLabs
C:\Users\user\PCAppStore\PcAppStore.exe5%ReversingLabs
C:\Users\user\PCAppStore\Uninstaller.exe8%ReversingLabs
C:\Users\user\PCAppStore\Watchdog.exe5%ReversingLabs
C:\Users\user\PCAppStore\download\ZoomInstaller.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\NW_store.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\ffmpeg.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libEGL.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\libGLESv2.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\node.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\notification_helper.exe0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\nw_elf.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll0%ReversingLabs
C:\Users\user\PCAppStore\nwjs\vulkan-1.dll0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
https://duckduckgo.com/ac/?q=0%URL Reputationsafe
http://anglebug.com/46330%URL Reputationsafe
https://anglebug.com/73820%URL Reputationsafe
https://issuetracker.google.com/2844622630%URL Reputationsafe
https://anglebug.com/77140%URL Reputationsafe
http://anglebug.com/62480%URL Reputationsafe
http://anglebug.com/69290%URL Reputationsafe
http://anglebug.com/52810%URL Reputationsafe
https://issuetracker.google.com/2554117480%URL Reputationsafe
https://anglebug.com/72460%URL Reputationsafe
https://anglebug.com/73690%URL Reputationsafe
https://anglebug.com/74890%URL Reputationsafe
https://issuetracker.google.com/1619030060%URL Reputationsafe
https://www.ecosia.org/newtab/0%URL Reputationsafe
http://anglebug.com/30780%URL Reputationsafe
http://anglebug.com/75530%URL Reputationsafe
http://anglebug.com/53750%URL Reputationsafe
http://anglebug.com/53710%URL Reputationsafe
http://anglebug.com/47220%URL Reputationsafe
http://anglebug.com/75560%URL Reputationsafe
https://chromewebstore.google.com/0%URL Reputationsafe
http://anglebug.com/66920%URL Reputationsafe
https://issuetracker.google.com/2582074030%URL Reputationsafe
http://anglebug.com/35020%URL Reputationsafe
http://anglebug.com/36230%URL Reputationsafe
http://anglebug.com/36250%URL Reputationsafe
http://anglebug.com/36240%URL Reputationsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://duckduckgo.com/chrome_newtabchrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://mail.google.com/mail/?usp=installed_webappchrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
    		unknown
    https://duckduckgo.com/ac/?q=chrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpfalse
    • URL Reputation: safe
    		unknown
    https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingchrome.exe, 00000001.00000002.3388043152.00001F5000064000.00000004.00000001.00020000.00000000.sdmpfalse
      		unknown
      https://pcapp.store/pixelgif.phpmchrome.exe, 00000001.00000002.3431543283.00001F5001458000.00000004.00000001.00020000.00000000.sdmpfalse
        		unknown
        https://pcapp.store/lp/appstore/img/favicon.icopHchrome.exe, 00000001.00000002.3432102343.00001F5001508000.00000004.00000001.00020000.00000000.sdmpfalse
          		unknown
          http://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjichrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpfalse
            		unknown
            http://dl.google.com/release2/chrome_component/cxxqn654fg7hzrcrrnqcniqqye_2024.10.11.1/kiabhabjdbkjdchrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpfalse
              		unknown
              https://docs.google.com/document/Jchrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
                		unknown
                https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpfalse
                  		unknown
                  http://anglebug.com/4633chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://dl.google.com/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgieaddgfechrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpfalse
                    		unknown
                    http://www.google.com/dl/release2/chrome_component/ad3skwo2srs5xchyxzz6ujgnedha_9.52.0/gcmjkmgdlgnkkchrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpfalse
                      		unknown
                      https://anglebug.com/7382chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:chrome.exe, 00000001.00000002.3418519744.00001F5000BE0000.00000004.00000001.00020000.00000000.sdmpfalse
                        		unknown
                        https://issuetracker.google.com/284462263chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklychrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpfalse
                          		unknown
                          https://delivery.pcapp.store/download.php?&src=mini_installer&file=1&mini_ver=&evt_src=fa_mini_instaSetup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://dns-tunnel-check.googlezip.net/connectchrome.exe, 00000001.00000002.3432681498.00001F5001540000.00000004.00000001.00020000.00000000.sdmpfalse
                              		unknown
                              https://dl.google.com/release2/chrome_component/adrga7eefaxjfdmmgfkiaxjg4yjq_2024.7.12.235938/eeigpnchrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpfalse
                                		unknown
                                http://www.google.com/dl/release2/chrome_component/adurx3xz3dy7ajnoguus4co3vr6q_9258/hfnkpimlhhgieadchrome.exe, 00000001.00000002.3419792507.00001F5000C70000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://docs.google.com/document/:chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://anglebug.com/7714chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    https://pcapp.store/pixelgif.phpPchrome.exe, 00000001.00000002.3430661494.00001F50013B8000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://pcapp.store_defaultchrome.exe, 00000001.00000002.3428110425.00001F500114D000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://unisolated.invalid/chrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://pcapp.store/inst_cpg.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&_fcid=1730271248380473&veSetup.exe, 00000000.00000003.2026333149.00000000007E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.google.com/chrome/tips/chrome.exe, 00000001.00000002.3406392524.00001F50007C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://www.google.com/dl/release2/chrome_component/cpx7rw4q3nwu7emczqf2w6cu7y_2023.3.30.1305/cocncanchrome.exe, 00000001.00000002.3398797921.00001F500066C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://drive.google.com/?lfhs=2chrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://anglebug.com/6248chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/6929chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://anglebug.com/5281chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://pcapp.store/tos.html?guid=Setup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nsq4808.tmp, 00000009.00000002.2495312828.00000000007BD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://www.google.com/dl/release2/chrome_component/acccxbt6wwsvpxzpob4hojndwkqq_4.10.2830.0/oimompechrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://www.youtube.com/?feature=ytcachrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://issuetracker.google.com/255411748chrome.exe, 00000001.00000002.3424438401.00001F5000F50000.00000004.00000001.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        https://csp.withgoogle.com/csp/analytics-container-tag-servingCross-Origin-Resource-Policy:chrome.exe, 00000001.00000002.3415276757.00001F5000A48000.00000004.00000001.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://docs.google.com/document/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3406286660.00001F50007AC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436188&cv=chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://pcapp.store/lp/appstore/img/favicon.icoN-chrome.exe, 00000001.00000002.3429679727.00001F5001328000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://pcapp.store/pixelgif.phpchrome.exe, 00000001.00000002.3431543283.00001F5001458000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430661494.00001F50013B8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3430261305.00001F50013AC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://anglebug.com/7246chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://anglebug.com/7369chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://anglebug.com/7489chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                  • URL Reputation: safe
                                                                  		unknown
                                                                  https://duckduckgo.com/?q=chrome.exe, 00000001.00000002.3397468169.00001F50005C0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    http://dl.google.com/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeachrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://chrome.google.com/webstorechrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://pcapp.stchrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3416025025.00001F5000AC0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3392253047.00001F500027C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://pcapp.store/rPchrome.exe, 00000001.00000002.3431963485.00001F50014F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://delivery.pcapp.store/MINGPROFILE=JOSetup.exe, 00000000.00000003.2026827122.0000000002AE6000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000002.2032906797.0000000002AE9000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppechrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://dl.google.com/release2/chrome_component/V3P1l2hLvLw_7/7_all_sslErrorAssistant.crx3chrome.exe, 00000001.00000002.3434204883.00001F50015D0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icochrome.exe, 00000001.00000002.3417923579.00001F5000B88000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://pcapp.storechrome.exe, 00000001.00000002.3419584106.00001F5000C68000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3424735946.00001F5000F7C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3388043152.00001F500007B000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3414662646.00001F5000A18000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3395337779.00001F500040C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F500073A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3423200308.00001F5000E9C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F5000738000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3420390373.00001F5000CA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://dl.google.com/release2/chrome_component/imoffpf67hel7kbknqflao2oo4_1.0.2738.0/neifaoindggfcjchrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://issuetracker.google.com/161903006chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        https://chrome.google.com/webstorePchrome.exe, 00000001.00000002.3397659242.00001F50005E0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://www.ecosia.org/newtab/chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          http://dl.google.com/release2/chrome_component/p2zbkxfgkqyr6ljey2oe3bnzoy_2023.11.29.1201/ggkkehgbnfchrome.exe, 00000001.00000002.3415761555.00001F5000A8C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://pcapp.store1chrome.exe, 00000001.00000002.3419584106.00001F5000C68000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://pcapp.store/Setup.exe, 00000000.00000002.2032146838.0000000000854000.00000004.00000020.00020000.00000000.sdmp, Setup.exe, 00000000.00000003.2026940195.0000000002AE8000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3387084981.00001F5000058000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3390738827.00001F500015C000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3425402037.00001F5000FD2000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3343345564.000001FDAEFA3000.00000002.00000001.00040000.0000001C.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3397037448.00001F5000588000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3417473523.00001F5000B73000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3423787216.00001F5000ED0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3415908871.00001F5000AAC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3123419597.00000067733FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3433944483.00001F50015B0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3435341636.00001F50018A0000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3228561196.000001FDACAED000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3426073550.00001F5001030000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3425864176.00001F5001018000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3403083164.00001F500073A000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3431963485.00001F50014F8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://duckduckgo.com/favicon.icochrome.exe, 00000001.00000002.3417473523.00001F5000B6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 00000001.00000002.3408084629.00001F5000864000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pchrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://pcapp.store/src/main.jschrome.exe, 00000001.00000002.3412583245.00001F5000930000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://anglebug.com/3078chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          http://anglebug.com/7553chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          http://anglebug.com/5375chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                          • URL Reputation: safe
                                                                                                          		unknown
                                                                                                          http://anglebug.com/7279dchrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            http://dl.google.com/release2/chrome_component/acdrpu5h5nrvazlb22ulljvgujnq_3048/jflookgnkcckhobaglnchrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://pcapp.storeHXchrome.exe, 00000001.00000002.3414943618.00001F5000A30000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://dl.google.com/release2/chrome_component/AMpg5-cnrANo_2018.8.8.0/2018.8.8.0_win64_win_third_pachrome.exe, 00000001.00000002.3420519334.00001F5000CB8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://anglebug.com/5371chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                  • URL Reputation: safe
                                                                                                                  		unknown
                                                                                                                  https://doubleclick.net/Ochrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://anglebug.com/4722chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://m.google.com/devicemanagement/data/apichrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 00000001.00000002.3406062770.00001F5000770000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://googletagmanager.com/cychrome.exe, 00000001.00000002.3429277393.00001F50012E0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://anglebug.com/7556chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          https://chromewebstore.google.com/chrome.exe, 00000001.00000002.3386639992.00001F500000C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          		unknown
                                                                                                                          https://pcapp.storeHchrome.exe, 00000001.00000002.3377799672.000001FDAF237000.00000004.00000001.00040000.00000000.sdmp, chrome.exe, 00000001.00000002.3427777999.00001F5001141000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3389610440.00001F50000EC000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://pcapp.storeDate:chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://pcapp.store/privacy.html?guid=welhttps://pcapp.store/pixel.gif?guid=&version=&evt_src=fa_minSetup.exe, 00000000.00000002.2032031620.000000000076A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://clients4.google.com/chrome-syncchrome.exe, 00000001.00000002.3391651275.00001F50001C4000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://analytics.google.com/g/collect?v=2&tid=G-VFQWFX3X1C&gtm=45je4au0h2v898645365za200zb910325665chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.google.com/dl/release2/chrome_component/ac6mhlwypzipnufijdvfyhdgvt4q_67/khaoiebndkojlmppchrome.exe, 00000001.00000002.3399009470.00001F5000698000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://unisolated.invalid/achrome.exe, 00000001.00000002.3413884541.00001F50009C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://anglebug.com/6692chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        		unknown
                                                                                                                                        https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0Cross-Origin-Opener-Policy-Report-Only:chrome.exe, 00000001.00000002.3283427795.000001FDAEB1D000.00000004.00000001.00040000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://issuetracker.google.com/258207403chrome.exe, 00000001.00000002.3424639814.00001F5000F6C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                          • URL Reputation: safe
                                                                                                                                          		unknown
                                                                                                                                          https://www.google.com/dl/release2/chrome_component/e6xlmsu5i2bokri3w4cyuhv4nq_2024.8.10.0/gonpemdgkchrome.exe, 00000001.00000002.3389725445.00001F50000FC000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3412683395.00001F5000950000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            http://anglebug.com/3502chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            		unknown
                                                                                                                                            http://anglebug.com/3623chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                            • URL Reputation: safe
                                                                                                                                            		unknown
                                                                                                                                            https://doubleclick.net/chrome.exe, 00000001.00000002.3418266147.00001F5000BA8000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3432681498.00001F5001540000.00000004.00000001.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.3418996338.00001F5000C1C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://anglebug.com/3625chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              		unknown
                                                                                                                                              https://tdsf.doubleclick.net/td/adfetch/gda?adg_id=163766597928chrome.exe, 00000001.00000003.2451613420.00001F5000F2C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://anglebug.com/3624chrome.exe, 00000001.00000002.3423887929.00001F5000EF0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                • URL Reputation: safe
                                                                                                                                                		unknown
                                                                                                                                                https://docs.google.com/presentation/Jchrome.exe, 00000001.00000002.3399571970.00001F50006D5000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public IPs

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  173.194.76.156
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.185.99
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.185.78
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.186.67
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  207.246.91.177
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		20473AS-CHOOPAUSfalse
                                                                                                                                                  142.250.186.174
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  159.223.126.41
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		46118CELANESE-USfalse
                                                                                                                                                  172.217.23.104
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.185.100
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.185.106
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  74.125.206.84
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  18.173.205.24
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		3MIT-GATEWAYSUSfalse
                                                                                                                                                  147.182.211.77
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		27555BV-PUBLIC-ASNUSfalse
                                                                                                                                                  142.250.186.72
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.184.200
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  172.217.16.142
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.186.98
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  142.250.184.195
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  1.1.1.1
                                                                                                                                                  		unknownAustralia
                                                                                                                                                  		13335CLOUDFLARENETUSfalse
                                                                                                                                                  170.114.52.2
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		22347DORSEY-WHITNEYUSfalse
                                                                                                                                                  142.250.186.162
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  195.181.170.18
                                                                                                                                                  		unknownUnited Kingdom
                                                                                                                                                  		60068CDN77GBfalse
                                                                                                                                                  142.250.181.226
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  239.255.255.250
                                                                                                                                                  		unknownReserved
                                                                                                                                                  		unknownunknownfalse
                                                                                                                                                  142.250.181.228
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  170.114.45.1
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		22347DORSEY-WHITNEYUSfalse
                                                                                                                                                  142.250.186.100
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                  169.150.255.183
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		2711SPIRITTEL-ASUSfalse
                                                                                                                                                  207.211.211.26
                                                                                                                                                  		unknownUnited States
                                                                                                                                                  		14135NAVISITE-EAST-2USfalse

                                                                                                                                                  Private

                                                                                                                                                  IP
                                                                                                                                                  192.168.2.4

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                  Analysis ID:1546037
                                                                                                                                                  Start date and time:2024-10-31 11:59:24 +01:00
                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 11m 56s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                  Number of analysed new started processes analysed:16
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:29
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Sample name:Setup.exe
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal51.spyw.evad.winEXE@35/289@0/30
                                                                                                                                                  EGA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 76%
                                                                                                                                                  • Number of executed functions: 209
                                                                                                                                                  • Number of non-executed functions: 129
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                                  Warnings

                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                  • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                  • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                  • VT rate limit hit for: Setup.exe

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  TimeTypeDescription
                                                                                                                                                  07:01:23API Interceptor471x Sleep call for process: Watchdog.exe modified
                                                                                                                                                  07:01:24API Interceptor255x Sleep call for process: explorer.exe modified
                                                                                                                                                  07:01:55API Interceptor1x Sleep call for process: PcAppStore.exe modified
                                                                                                                                                  11:01:28AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                  11:01:37AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                  11:01:45AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092c
                                                                                                                                                  11:01:54AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PCAppStore "C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                  11:02:02AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PcAppStoreUpdater "C:\Users\user\PCAppStore\AutoUpdater.exe" /i
                                                                                                                                                  11:02:11AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Watchdog "C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092c
                                                                                                                                                  11:02:23Task SchedulerRun new task: ZoomUpdateTaskUser-S-1-5-21-2246122658-3693405117-2476756634-1002 path: "C:\Users\user\AppData\Roaming\Zoom\bin\Zoom.exe" s>--action=UpdateSchedule

                                                                                                                                                  LLM Input / Output

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                  • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                                                  AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 1.1.1.1/
                                                                                                                                                  INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                  • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                                                  Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 1.1.1.1/
                                                                                                                                                  170.114.52.2S23UhdW5DH.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, StealcBrowse
                                                                                                                                                  • gitam.zoom.us/pma/
                                                                                                                                                  207.246.91.177Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                    Setup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                      18.173.205.24https://www.research.net/r/8BZPWB2Get hashmaliciousUnknownBrowse
                                                                                                                                                        https://shop.ketochow.xyz/Get hashmaliciousUnknownBrowse
                                                                                                                                                          159.223.126.41tKr6T60C1r.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            MDE_File_Sample_ba40401128d2ff2734a7e554120b7de438870654.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                              https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj85-Cx0Pz-AhV5FVkFHezeDZcQFnoECCUQAQ&url=https%3A%2F%2Fwww.dltk-teach.com%2Frhymes%2Fmacdonald%2Fmlyrics.htm&usg=AOvVaw0mYQOAG6hFsIBU_fVcAryoGet hashmaliciousUnknownBrowse

                                                                                                                                                                Domains

                                                                                                                                                                ⊘No context

                                                                                                                                                                ASNs

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                CELANESE-USK3Kvd8JYGV.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.211.130
                                                                                                                                                                https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7Get hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.103.226
                                                                                                                                                                https://netorgft4648155-my.sharepoint.com/:f:/g/personal/cgriffith_nationsbest_net/ErhP9j6s6O5LtAYvSf-k7fgBJJeB0TUcEyK1gf2JqcFeEw?e=iS1Nd2Get hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.103.226
                                                                                                                                                                7ffbfc130000.conhost2.dll.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                7ffbfc130000.conhost2.dll.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                VOqg4bXfFS.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                tZlDJKdfV6.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                7ff6c1d70000.xxtlz.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                Y1kJT9dEK1.dllGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                7ff6c1d70000.xxtlz.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 159.223.46.184
                                                                                                                                                                MIT-GATEWAYSUShttps://invite.bublup.com/q6fU7gLtMrfSGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 18.66.147.7
                                                                                                                                                                https:/click.mailchimp.com/track/click/30010842/docsend.com?p=eyJzIjoiT2RaN0hwNHlyY2E3VXl5TWcwMlA2eFpHVlN3IiwidiI6MSwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2RvY3NlbmQuY29tXFxcL3ZpZXdcXFwvZzZnYzZjazdtNHlkYTRpa1wiLFwiaWRcIjpcImNhZDg3NzI1Y2UzMjRiMzI4Yzk1ZGVkYWUyMzc4ZTZjXCIsXCJ1cmxfaWRzXCI6W1wiYzE5ZWU5NGJiMzA5YmZhOGQ2MDU3OGI1Mjk5NTFmOWE4NDQ0ODNhYVwiXX0ifQ#steven.davis@tu.eduGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 18.173.205.62
                                                                                                                                                                https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editorGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.66.102.102
                                                                                                                                                                Reminders for Msp-partner_ Server Alert.emlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 18.172.103.101
                                                                                                                                                                https://wetransfer.com/downloads/bd15c1f671ae60c5a56e558eb8cc43bf20241030150256/3b30cd5b9ce1ffb29d79c9118153941c20241030150256/70baef?t_exp=1730559776&t_lsid=6bd545a9-d09b-4abd-a317-124dbe9fe64d&t_network=email&t_rid=YXV0aDB8NjZlYWI0YTExODhmYzc1OGMzMmNiODIx&t_s=download_link&t_ts=1730300576&utm_campaign=TRN_TDL_01&utmGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                • 18.172.103.101
                                                                                                                                                                https://www.mediafire.com/file/oyfycncwen0a3ue/DSP_Plan_Set.zip/fileGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.173.205.112
                                                                                                                                                                Receipt.htmGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.66.122.33
                                                                                                                                                                https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963Get hashmaliciousKnowBe4Browse
                                                                                                                                                                • 18.173.205.50
                                                                                                                                                                https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963Get hashmaliciousKnowBe4Browse
                                                                                                                                                                • 18.173.205.50
                                                                                                                                                                https://www.guidedtrack.com/programs/n5snx1a/runGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 18.66.102.11
                                                                                                                                                                AS-CHOOPAUSwZU2edEGL3.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 204.80.129.14
                                                                                                                                                                belks.spc.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                • 95.179.203.61
                                                                                                                                                                jew.arm.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 66.42.126.74
                                                                                                                                                                nklx86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 66.42.54.66
                                                                                                                                                                splarm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 45.76.22.31
                                                                                                                                                                nabmpsl.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 45.32.162.126
                                                                                                                                                                la.bot.sh4.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 45.32.140.17
                                                                                                                                                                kkkmpsl.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 44.40.163.28
                                                                                                                                                                prog.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                • 95.179.241.203
                                                                                                                                                                la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                • 149.253.134.252

                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                ⊘No context

                                                                                                                                                                Dropped Files

                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                C:\Users\user\AppData\Local\Temp\nsi277F.tmp\System.dllWARUNKI UMOWY-pdf.bat.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                  VERTRAG-pdf.bat.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                    S#U00f6zle#U015fme Anla#U015fmalar#U0131-pdf.bat.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                      VERTRAG-pdf.bat.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                        WARUNKI UMOWY-pdf.bat.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                          VERTRAG-pdf.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                            https://on-combine-data.s3.us-west-2.amazonaws.com/dealer-data/Share+Point/NTAS_MS3000X_Installer_v2.8.25_October2024_NO_UPS.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                              https://www.ccleaner.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                SetupEngine.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  https://veryfast.ioGet hashmaliciousUnknownBrowse

                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002d.db

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\explorer.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):106768
                                                                                                                                                                                    Entropy (8bit):4.022591797962021
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:ls7Fk3r1kDGsHhXXjk0Yct63CXBwNXLF/aJIYXxkxvRCR1vcdPk8dRmRypE3oXBT:lLknHptImBNubhBiQG9n1aFjKGGGx
                                                                                                                                                                                    MD5:90C6C6EF68AF95827B081411726E600E
                                                                                                                                                                                    SHA1:A694227F9551B8FE69C135DDC1CA3E38C2BD3BF7
                                                                                                                                                                                    SHA-256:F64FC1F975EDC3BCBCFBCCC0BE3CD07C7D3F7E90A1EDCE9D9F042EE999CEA1D4
                                                                                                                                                                                    SHA-512:6BC7F1F23FF7D60C8ADFB3AB38C50689A2B71EAC02DFBD3DA66CAD10F43C9A5CCBCC789081DC1A156F87E18CA5DE6AC436718812C3969B0C5569C3152C28F7B6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....h... ...............P...............Z...(..._...h...................X.......e.n.-.C.H.;.e.n.-.G.B..............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002e.db

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Windows\explorer.exe
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):109288
                                                                                                                                                                                    Entropy (8bit):4.021877670297022
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:768:CObFu3DMk0GoNAdRyZHjk0VBYyqKbtqNSLqJafJK278GxLCTR1v4K2OjJxmPypRG:CmkmmPMYRatw7Fh/i0GGnz6FTKFfO
                                                                                                                                                                                    MD5:38EAD386F0AB50F2630CD1C73BABFD99
                                                                                                                                                                                    SHA1:615D2250264B15E089E225AA524565B1EC47F4B6
                                                                                                                                                                                    SHA-256:E82EB1197E67C8FFC6DDD5DCD0D2D9C5934A706FB80D61549F8BB4E6AD00BE68
                                                                                                                                                                                    SHA-512:1E7ACF261A1A7BC615D574337836B33B800D6848E0FE0BC0DDA39A4C78FDCE0CD30F1AD0B2D156912F107EAEE9B3400DA7E473193E595944C1313475C1C9E942
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:....h... ......p.......P...........p...\......a...8..............h...Z.......e.n.-.C.H.;.e.n.-.G.B...............X..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.................. ..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[1].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[2].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[3].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[4].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[5].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[6].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[7].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[8].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\p[9].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[10].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[1].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[2].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[3].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[4].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[5].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[6].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[7].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[8].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[1].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[2].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[3].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[4].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[5].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[6].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[7].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\p[8].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[1].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[2].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[3].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[4].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[5].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[7].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[8].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\p[9].gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\NSISFastLib.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):140288
                                                                                                                                                                                    Entropy (8bit):6.334087823000165
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                    MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                    SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                    SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                    SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\System.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):5.814115788739565
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                    MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                    SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                    SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                    SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                    • Filename: WARUNKI UMOWY-pdf.bat.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: VERTRAG-pdf.bat.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: S#U00f6zle#U015fme Anla#U015fmalar#U0131-pdf.bat.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: VERTRAG-pdf.bat.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: WARUNKI UMOWY-pdf.bat.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: VERTRAG-pdf.zip, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: , Detection: malicious, Browse
                                                                                                                                                                                    • Filename: , Detection: malicious, Browse
                                                                                                                                                                                    • Filename: SetupEngine.exe, Detection: malicious, Browse
                                                                                                                                                                                    • Filename: , Detection: malicious, Browse
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\image.gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):997
                                                                                                                                                                                    Entropy (8bit):4.188896534234179
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                    MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                    SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                    SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                    SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39424
                                                                                                                                                                                    Entropy (8bit):4.684597989866362
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                    MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                    SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                    SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                    SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\modern-wizard.bmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):26494
                                                                                                                                                                                    Entropy (8bit):1.9568109962493656
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
                                                                                                                                                                                    MD5:CBE40FD2B1EC96DAEDC65DA172D90022
                                                                                                                                                                                    SHA1:366C216220AA4329DFF6C485FD0E9B0F4F0A7944
                                                                                                                                                                                    SHA-256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
                                                                                                                                                                                    SHA-512:62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsDialogs.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9728
                                                                                                                                                                                    Entropy (8bit):5.158136237602734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
                                                                                                                                                                                    MD5:6C3F8C94D0727894D706940A8A980543
                                                                                                                                                                                    SHA1:0D1BCAD901BE377F38D579AAFC0C41C0EF8DCEFD
                                                                                                                                                                                    SHA-256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
                                                                                                                                                                                    SHA-512:2094F0E4BB7C806A5FF27F83A1D572A5512D979EEFDA3345BAFF27D2C89E828F68466D08C3CA250DA11B01FC0407A21743037C25E94FBE688566DD7DEAEBD355
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L.....Oa...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsi277F.tmp\nsJSON.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24064
                                                                                                                                                                                    Entropy (8bit):5.819708895488079
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                    MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                    SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                    SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                    SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\Math.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):69120
                                                                                                                                                                                    Entropy (8bit):6.024967061017882
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
                                                                                                                                                                                    MD5:85428CF1F140E5023F4C9D179B704702
                                                                                                                                                                                    SHA1:1B51213DDBAEDFFFB7E7F098F172F1D4E5C9EFBA
                                                                                                                                                                                    SHA-256:8D9A23DD2004B68C0D2E64E6C6AD330D0C648BFFE2B9F619A1E9760EF978207A
                                                                                                                                                                                    SHA-512:DFE7F9F3030485CAF30EC631424120030C3985DF778993342A371BF1724FA84AA885B4E466C6F6B356D99CC24E564B9C702C7BCDD33052172E0794C2FDECCE59
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.................F.........................5.....5....:6....Rich...........PE..L.....Oa...........!................KG....................................................@.............................B.......(....................................................................................................................text...b........................... ..`.rdata..R...........................@..@.data............2..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\NSISFastLib.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):140288
                                                                                                                                                                                    Entropy (8bit):6.334087823000165
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:H5dnvmOEATceozVDkRasOCdUFZrR7beB2SK0XCC+W/ST+BeXZQUC5:ZdnvmsTceZUtCdUFZr9b4KznC5
                                                                                                                                                                                    MD5:9C7A4D75F08D40AD6F5250DF6739C1B8
                                                                                                                                                                                    SHA1:793749511C61B00A793D0AEA487E366256DD1B95
                                                                                                                                                                                    SHA-256:6EB17C527C9E7F7FEA1FDB2EA152E957B50A56796E53CE1E5946B165B82DEAEF
                                                                                                                                                                                    SHA-512:E85235307B85FFD3AAB76FF6290BEE0B3B9FD74C61A812B5355FE7B854D4C6B77BD521E52638D28E249A43D9EC7AA6F2670AF2B1C671091492C7FE19D6F9A4E6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......../.iTN.:TN.:TN.:.6.;^N.:.6.;.N.:.6.;@N.:.6.;UN.:...;AN.:...;DN.:...;{N.:.6.;_N.:TN.:'N.:B..;QN.:B..;UN.:B.%:UN.:TNM:UN.:B..;UN.:RichTN.:........................PE..L...z..f...........!...(.x...................................................`..............................................x...x....0..X....................@......0...............................p...@............................................text...0v.......x.................. ..`.rdata..\~...........|..............@..@.data...............................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\System.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12288
                                                                                                                                                                                    Entropy (8bit):5.814115788739565
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
                                                                                                                                                                                    MD5:CFF85C549D536F651D4FB8387F1976F2
                                                                                                                                                                                    SHA1:D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
                                                                                                                                                                                    SHA-256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
                                                                                                                                                                                    SHA-512:531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\image.gif

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:GIF image data, version 89a, 16 x 16
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):997
                                                                                                                                                                                    Entropy (8bit):4.188896534234179
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12:2E5KZbHOjOruFw6MLxENScRVar7FC53tK1Oqd3Aa0n:tAlHOjOX60ENvRVZKbEn
                                                                                                                                                                                    MD5:1636218C14C357455B5C872982E2A047
                                                                                                                                                                                    SHA1:21FBD1308AF7AD25352667583A8DC340B0847DBC
                                                                                                                                                                                    SHA-256:9B8B6285BF65F086E08701EEE04E57F2586E973A49C5A38660C9C6502A807045
                                                                                                                                                                                    SHA-512:837FA6BCBE69A3728F5CB4C25C35C1D13E84B11232FC5279A91F21341892AD0E36003D86962C8AB1A056D3BEEB2652C754D51D6EC7EEE0E0EBFE19CD93FB5CB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a............P..........4q...5j...O..F.].......................o..._.....5y.t........\....K>}...g..t....X...B..ET....t~....go..Jx...........|..U!f.|....>u.M.........w>..+r...|...A{.....t...E...b.8}....d....A.....R..y..l...w....G5u...{....t.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!.......,...............H..A....`pp....~.xR......d.......,...D...)2 .1.....N` R......(@......,8RDA../..XB....P.F .....#...b`F...#8p......<\.`.........A....n|.CH...........+... .E.....d`.@......;

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):39424
                                                                                                                                                                                    Entropy (8bit):4.684597989866362
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
                                                                                                                                                                                    MD5:A35CDC9CF1D17216C0AB8C5282488EAD
                                                                                                                                                                                    SHA1:ED8E8091A924343AD8791D85E2733C14839F0D36
                                                                                                                                                                                    SHA-256:A793929232AFB78B1C5B2F45D82094098BCF01523159FAD1032147D8D5F9C4DF
                                                                                                                                                                                    SHA-512:0F15B00D0BF2AABD194302E599D69962147B4B3EF99E5A5F8D5797A7A56FD75DD9DB0A667CFBA9C758E6F0DAB9CED126A9B43948935FE37FC31D96278A842BDF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........&.[.H.[.H.[.H.O.I.R.H.[.I...H...M.Y.H...L.Z.H...H.Z.H.....Z.H...J.Z.H.Rich[.H.................PE..L...n..c...........!.....T.........._........p............................... ............@..........................x......D...d...............................t....w..8...............................................D............................text....S.......T.................. ..`.rdata.......p.......X..............@..@.data....i...........d..............@....idata..A............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsj906B.tmp\nsJSON.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):24064
                                                                                                                                                                                    Entropy (8bit):5.819708895488079
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
                                                                                                                                                                                    MD5:F4D89D9A2A3E2F164AEA3E93864905C9
                                                                                                                                                                                    SHA1:4D4E05EE5E4E77A0631A3DD064C171BA2E227D4A
                                                                                                                                                                                    SHA-256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
                                                                                                                                                                                    SHA-512:DBDA3FE7CA22C23D2D0F2A5D9D415A96112E2965081582C7A42C139A55C5D861A27F0BD919504DE4F82C59CF7D1B97F95ED5A55E87D574635AFDB7EB2D8CADF2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.'..fI_.fI_.fI_3.H^.fI_.fH_?fI_.8M^.fI_.8I^.fI_.8._.fI_.8K^.fI_Rich.fI_........PE..L...`..Z...........!.....>..........E........P............................................@..........................X......@Z..P....p..........................H....X...............................................P...............................text...W<.......>.................. ..`.rdata.......P.......B..............@..@.data...@....`.......R..............@....rsrc........p.......T..............@..@.reloc..H............X..............@..B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsq4808.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):93386616
                                                                                                                                                                                    Entropy (8bit):7.99999306217129
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:1572864:52KX1mfH5AoIZnp9/pkhKzHjrSADzxet6X3mRsDqpszbyxjpB3ayh1sN1KGoMy1u:5jExAJh/pksTnFet6mu2G0jptggJ+flP
                                                                                                                                                                                    MD5:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                    SHA1:950A437488464103B9BF34610962C22192585BFC
                                                                                                                                                                                    SHA-256:F42D2BF4A50AB0CDB4A1C43964F0429C4663E27C76D8C61AFA174A531A7819A1
                                                                                                                                                                                    SHA-512:132C9BE1217804B73F8A99EA44D702E9DA0782CB6BBCC80DB2C2C72BDA1A93D06B2ADEF1B464F9163311F7482B2400553BA082C0F7F3CCF3B42C8C9B881306EB
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ............@.............................................HO.......... ..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\nsu905B.tmp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):318525781
                                                                                                                                                                                    Entropy (8bit):6.931313706371873
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3145728:EEnqgvUBRlhK9QJiDS610scieJq1SXCSnsmdAGonTn:EEIKe0Djq7hCSkH
                                                                                                                                                                                    MD5:1E82AC21A0AB4FB084013AC7F54B3647
                                                                                                                                                                                    SHA1:152308A3F71C6CB7EADC4A6ECE3991E679CFC92F
                                                                                                                                                                                    SHA-256:6A776340A1B9EC3E8094D3B46C247A3144F882D57AD976E6467407B8E09C3204
                                                                                                                                                                                    SHA-512:A2F2C3C83F2FA83EEDBC3D70BF60E7DD16794B7DACD41FF2DA225034349ED2FDA070BA12F4E5E880A5B5FD81FA58B9C115B9A5812728575750704647654FDE89
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.7......,.......,.......D...=...........^6......\7..............................................................m...........................................................................................................................................................................3................2..................................................................................................................................j.......................k...................................................................................................................s..........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\temp

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Fri Oct 25 14:14:38 2024, mtime=Thu Oct 31 10:01:23 2024, atime=Fri Oct 25 14:14:38 2024, length=3116888, window=hide
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1857
                                                                                                                                                                                    Entropy (8bit):3.4868051627959367
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24:8cspSPEkNFdyABN6RknwtkkyHiO/79zfqyFm:8VwPEkN3RnkknOyHiTyF
                                                                                                                                                                                    MD5:E115C6E8398970D6CF65FB869BA678A4
                                                                                                                                                                                    SHA1:DAD7DA9D9CE2A8AFC472E0C447C58A235D67C843
                                                                                                                                                                                    SHA-256:12688BACA15575E488A829864363206DD9FA78528C266AB566B7AA2AC465E17E
                                                                                                                                                                                    SHA-512:4DC8A68E05B2B15EA5EC6878842DCCEA35CE063781AEF3F98C0369A833EBD3A5A9F680E490F61AFF283FF6E5D4813E26D4C0AC462B407CC8E11C2E569FECC24E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:L..................F.@.. .....y..&....`9.+....y..&..X./.....................0.:..DG..Yr?.D..U..k0.&...&......vk.v....a.8&.+..@Ur9.+......t...CFSF..1....._Y+X..PCAPPS~1....t.Y^...H.g.3..(.....gVA.G..k...F......_Y.X_Y+X....D......................Q..P.C.A.p.p.S.t.o.r.e...D.j.2.X./.YY.y .PCAPPS~1.EXE..N......YY.y_Y,X..........=...................P.c.A.p.p.S.t.o.r.e...e.x.e.......W...............-.......V....................C:\Users\user\PCAppStore\PcAppStore.exe..+.....\.....\.....\.....\.....\.....\.P.C.A.p.p.S.t.o.r.e.\.P.c.A.p.p.S.t.o.r.e...e.x.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.../.i.n.i.t. .d.e.f.a.u.l.t. .s.h.o.w.M.(.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.P.C.A.p.p.S.t.o.r.e.\.p.c.a.p.p.s.t.o.r.e...i.c.o.........%USERPROFILE%\PCAppStore\pcappstore.ico.............................................................................................................................................................................................................................%

                                                                                                                                                                                    C:\Users\user\PCAppStore\AutoUpdater.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):586584
                                                                                                                                                                                    Entropy (8bit):6.337989770444409
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:BYnWgtbxN7L7kYcMB/cA4hxWbZKcXErHNkQLtZ9wNmCc0r93SFzd7FSAaxXDj5w:BYnWC7sQB/cA4nLrtkWemCn9YBUxXXy
                                                                                                                                                                                    MD5:693221C78FDC00A0F87FB3D1381308D4
                                                                                                                                                                                    SHA1:5ABD1481B0918A1815B542BFCB2EAD542C233DB8
                                                                                                                                                                                    SHA-256:6BB4786AB76767D1F9B2E19FD1A20F2F76CF1BB96127FC26741F2BE609E7680D
                                                                                                                                                                                    SHA-512:A58F0A1EA54ED94EDF3129088D89F2064F7D93ECD30F9590307963B287C8FF45580DC4D9A48F6D6C4AF72DB6E1E82EEF0EA3E4BF756B93B159C3CDE808041CFD
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................f....f....f...............g.....gH.... ....g....Rich...........PE..d......g.........."....).....V.................@.....................................x....`.................................................P............G...P..PR......X)..........P...T.......................(.......@............................................text............................... ..`.rdata...m.......n..................@..@.data....<....... ..................@....pdata..PR...P...T... ..............@..@.rsrc....G.......H...t..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\PcAppStore.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3116888
                                                                                                                                                                                    Entropy (8bit):5.959240683924359
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:V9kabuTUmENsEyg1IgoPYbvE8C9BHv3QJTbiNG8g9MEiYQgsSryyH2mtJXKMCSd+:V5bGEXi8mPY9pMFxu7cnZN3
                                                                                                                                                                                    MD5:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                    SHA1:0980A7B75DB94035A5DE1696210648ACB95ACEDE
                                                                                                                                                                                    SHA-256:D4DE255AE1109391E4A4A967A8AD66DFB70FCCA7DB47777E40815F4E7B19F2A2
                                                                                                                                                                                    SHA-512:0F87422498ED3C60ED21CDA492D038D10509E3B40E5E9D7614B6CB0EF903E241AD1BA9C2F67B43D9DA3980990735A5E0C325002E43E0A41CB12947E2DBECF19F
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l4 O.ZsO.ZsO.Zs.uYrG.Zs.u_r..Zs_.^r\.ZsFu.sM.Zs_.YrC.Zs_._r$.Zs.u^rX.Zs.u\rN.Zs.u[rf.ZsO.[s..Zs..^rM.Zs.._r~.Zs...sN.ZsO..sN.Zs..XrN.ZsRichO.Zs........PE..d......g.........."....)..&..........+"........@.............................P0....../...`...................................................*......./.P^....-......f/.X)... 0..&..0").p....................$).(.... ).@.............&.H............................text.....&.......&................. ..`.rdata...`....&..b....&.............@..@.data...H.... +.......+.............@....pdata........-.......,.............@..@.rsrc...P^..../..`..................@..@.reloc...&... 0..(...>/.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\ReadMe.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):146
                                                                                                                                                                                    Entropy (8bit):4.577360416859904
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:TKPyFfliFRNAl2sIaRjyM1KOTxLELMZ4MKLJF8EelYq8AsXJVVWM4v:TyyFflmSssI+j1NLELM6MKn8EquZVVCv
                                                                                                                                                                                    MD5:2845450EA9D938CFEA9809CA0C827F12
                                                                                                                                                                                    SHA1:8DE2189530DA5923365436C37E4C55C500AC3FBF
                                                                                                                                                                                    SHA-256:7FDADB3CA5B81C6D1C58A20610921BF89D63DC65B77BE982F422C6FD2A13F166
                                                                                                                                                                                    SHA-512:7D19FE6E9DD51BB880FD6FBB7EE126C8078771EE5166D53F312B04D117CE2897CBB6DFB5E5627314C3CF8B56F7A2BBF5B9D38258E7912B0AC5D420B611B7C363
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:Fhis folder contains the PC App Store for Microsoft Windows.....For additional information, please visit https://pcapp.store/?p=lpd_appstore-faq..

                                                                                                                                                                                    C:\Users\user\PCAppStore\Temp\tempPOSTData

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2257
                                                                                                                                                                                    Entropy (8bit):5.172315567704891
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:48:YZ1HdtyDF9hCy3ZMqr8ZPfOqfYLkGYOOzfhrE+ynWL7NKZ6yFmgkM92dmOvbVh:oNdAQypMtZPPALkOOzVpynWL7NKZlFmr
                                                                                                                                                                                    MD5:FEC7F212671BBA688F12DEDC2A15642C
                                                                                                                                                                                    SHA1:C7F9FB688ABD0EA0124E54D01BCE3254B936FF03
                                                                                                                                                                                    SHA-256:DCE57CA043853C6C6406BC236861A6950C3F6F02272189944D30EEB342884F9A
                                                                                                                                                                                    SHA-512:B6563C1262FEBE2FB8902EF2815CCDB7ECCDAA8FB5E9B8F1784A3379A13496FBBBAF3DC8C0B5A14F1DE875462AE1624AF6C5830E295E14BE641F0415002829AC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"system_stats":{"os_name":"Microsoft+Windows+10+Pro","os_installdate":"20231003095718%2E000000%2B060","os_processes":"113","os_architecture":"64-bit","os_virtmem":"8387636","os_mem":"4193332","cpu_name":"Intel%28R%29+Core%28TM%292+CPU+6600+%40+2%2E40+GHz","cpu_maxclock":"2000","cpu_cores":"4","cpu_logicalproc":"1","pc_vendor":"VMware%2C+Inc%2E","pc_version":"None","gpu_name":"PR8CPK3Y","gpu_ram":"0","gpu_bitsperpixel":"32","gpu_x":"1280","gpu_y":"1024","disk_name":"GWPE9XE3+SCSI+Disk+Device","disk_size":"412300001200","sec_as":"","sec_av":"Windows+Defender","sec_fw":"","bios_releasedate":"20221121000000%2E000000%2B000"},"pcapps":{"0":"7-Zip+23%2E01+%28x64%29","1":"Mozilla+Firefox+%28x64+en-US%29","2":"Mozilla+Maintenance+Service","3":"Microsoft+Office+Professional+Plus+2019+-+en-us","4":"Microsoft+Visual+C%2B%2B+2022+X64+Additional+Runtime+-+14%2E36%2E32532","5":"Office+16+Click-to-Run+Licensing+Component","6":"Office+16+Click-to-Run+Extensibility+Component+64-bit+Registration","7":"A

                                                                                                                                                                                    C:\Users\user\PCAppStore\Temp\tempPOSTResponse

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):73
                                                                                                                                                                                    Entropy (8bit):4.089026662492467
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3:YGVE8fptxgDQLRv6zjQJNRvUXZ5:YGFRt9IoNaZ5
                                                                                                                                                                                    MD5:3024A54E0C352ABE5EB5F753CA4828DA
                                                                                                                                                                                    SHA1:DF0206851654405C8E5C2D3BC96FB536B8C2DCBF
                                                                                                                                                                                    SHA-256:3CD0A703506C7394D6115D9FF721516560894358AEF07459F30D8930DF6C3B61
                                                                                                                                                                                    SHA-512:D9D44051DF56B29AA596EE38463B781DBE27F917F7DAE1B2420122616DA108520429DDA58C75C7E6B2D41093F83C5A4BAE96024885AF3956F23A3CE5BD3F9358
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"cpg":"default","inst_excl":null,"inst_addon":null,"inst_advanced":null}

                                                                                                                                                                                    C:\Users\user\PCAppStore\Uninstaller.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):93880
                                                                                                                                                                                    Entropy (8bit):6.891280387415397
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1536:2msAYBdTU9fEAIS2PEtu3rLFn22G9RowU49TV1Z43kUFInU73ALu:FfY/TU9fE9PEtubZrMtkkxUUi
                                                                                                                                                                                    MD5:CD8B6F1BD281C288FB3F68925639B424
                                                                                                                                                                                    SHA1:25EA108C45905418B8FDA2FCCF5ADA0EDE2710E5
                                                                                                                                                                                    SHA-256:808FE10CBF09F21359E1D61860BFCDDE553F5CDA38723ECD0636FA25F652121D
                                                                                                                                                                                    SHA-512:A05C60EA499BEA246FF0CB3308108862CDC56BC44A4E14F546FE8AF4C52172F73F5973EBA03FF1F2BB1C575C15BF62421034C02AFA703D093B986F95A999E1B6
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 8%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................h...*......@6............@.......................... ......f.....@.............................................HO..........`E..X)...........................................................................................text...vf.......h.................. ..`.rdata...............l..............@..@.data...x...........................@....ndata... ...............................rsrc...HO.......P..................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\Watchdog.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):276312
                                                                                                                                                                                    Entropy (8bit):6.155274238783893
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:JNh5y0IKTcOq1wpRsrIA/uuNT4KddgLA/exq10mMfnW9L/or6RMr4T+cnOMX4Hen:jyJKA5KKdWLA/GZhnWlV94+3H3
                                                                                                                                                                                    MD5:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                    SHA1:91572872A265185E7F9793B50C5257B511707B36
                                                                                                                                                                                    SHA-256:5BD22345C42FC1B7C89C281C9247BC81DBBDB4C8EF4DA76E2A9D86589D8CC118
                                                                                                                                                                                    SHA-512:B7E1A5F391E112AAC0CFA8239AD5AE784161C8734C9A4F3EF386FF617915F7AC769A5DB790B66BD95E6DAB8BAABCC4E51DE31D614193CB69909DF393DC77A021
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P........................H............Q.......Q.......Q..................t....P.......P&.......N......P......Rich............................PE..d......g.........."....).............,.........@.............................p...........`.....................................................x........G.......1......X)...`.......O..p....................Q..(...PN..@............................................text............................... ..`.rdata..............................@..@.data....%...........|..............@....pdata...1.......2..................@..@.rsrc....G.......H..................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\download\ZoomInstaller.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:modified
                                                                                                                                                                                    Size (bytes):40940408
                                                                                                                                                                                    Entropy (8bit):7.999404871915945
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:786432:hlonUQSCQ2cnGK1CXK3EquppO9757eJ9Tz093mGc9Dv2eaH5PlLQsPDs6VJ:joPSCQ2cdCXK3Eq8pI+9To9WT9DPad1T
                                                                                                                                                                                    MD5:F232E3873A1692C9BC5A349199555045
                                                                                                                                                                                    SHA1:961861915D32851866BABA8BAB7F9528C74E2AA3
                                                                                                                                                                                    SHA-256:9F35C01FF7901292A2591240572E33B4CD54CAD284AA59926D85B1CDC3657CD7
                                                                                                                                                                                    SHA-512:B1B28560EFB72D4645F093690B7E1C784365A1B6EC72B9C9900680C3C90511B41E87D27675FDEA4FB41782A103C436E5B194A8FADEE6CC5258C13023F7E78C3D
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aW..%6.%6.%6.1].,6.%6..6.wC..6.wC.76.wC.,6.1].)6.1]."6.1].6..C.q6..C..$6.%6{.$6..C.$6.Rich%6.........PE..d.....f.........."..........\.................@.............................P......z.q...`.....................................................d.......(....P...*..@Tp.8_...@.......g..8............................g..8............................................text............................... ..`.rdata..*...........................@..@.data...._..........................@....pdata...*...P...,..................@..@_RDATA..............................@..@.rsrc...(...........................@..@.reloc.......@......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\NW_store.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2312704
                                                                                                                                                                                    Entropy (8bit):6.449649685576397
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:49152:gg6wrmvfu6ZPfRFq8BcvDEzT3CuaMUgKS:H8Zn3Ci
                                                                                                                                                                                    MD5:E472E46BDFD736351D4B086B4C4CA134
                                                                                                                                                                                    SHA1:1AA886F0CB23B3D322A43BE797D411FCA84D82A7
                                                                                                                                                                                    SHA-256:E825A252B5C5C9C2DE8A6A6ADE12A7F9CD0040F6A20E6EE44BA659034E6D5223
                                                                                                                                                                                    SHA-512:173F5A7ABDFEA01C9C21EC716CBA14EEC4539DA45E5734B3FD1E0688E1C22E4718BD701C25C8040D20CF48867E2A67EF2ABA46380BAB9AB1F7A42BD66FD33AFB
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."..........R.......R.........@.............................0$...........`.........................................',.......,..d....0........................$.@!..l...8...................@...(.......8............4..........`....................text...X........................... ..`.rdata..............................@..@.data............F..................@....pdata..............................@..@.gxfg...P........0..................@..@.retplne.............N...................tls.................P..............@....voltbl.D............T..................CPADinfo8............V..............@..._RDATA...............X..............@..@malloc_h0.... .......Z.............. ..`.rsrc........0.......\..............@..@.reloc..@!....$.."...(#.............@..B................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\credits.html

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9560433
                                                                                                                                                                                    Entropy (8bit):4.8475056659478915
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:/28lTEaiPJK0PJgVEv+F26vbV2f2EvYvAKMc/+uBPJ1PJLPJ1PJOPJDKspVosXxY:/2ETWgqSq+sIp2+qO1McdLRPiY2zXO
                                                                                                                                                                                    MD5:7A32B7C762C76BD3EE38E3E998705899
                                                                                                                                                                                    SHA1:E1C611A57115374A48CD84619BD06E43021B7352
                                                                                                                                                                                    SHA-256:726276A62DB14DD751F32B77200E90A8000712BD256ED038BEA928C6AEF0C892
                                                                                                                                                                                    SHA-512:9FE66FE4479915B0EFE12ADFB386BA251B2C2AF8CCD92B4D67F61C9D2AE537C6D3512E4379AFF10EAB3CD433FC1EDEC702E63DDFE4F83769A746FF249288D4DA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview: Generated by licenses.py; do not edit. --><!doctype html>..<html>..<head>..<meta charset="utf-8">..<meta name="viewport" content="width=device-width">..<meta name="color-scheme" content="light dark">..<title>Credits</title>..<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">..<link rel="stylesheet" href="chrome://credits/credits.css">..</head>..<body>..<span class="page-title">Credits</span>..<a id="print-link" href="#" hidden>Print</a>..<label class="show show-all" tabindex="0">..<input type="checkbox" hidden>..</label>..<div class="open-sourced">.. Chromium software is made available as source code.. <a href="https://source.chromium.org/chromium">here</a>...</div>....<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->..<div class="product">..<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>..<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">h

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\d3dcompiler_47.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4916712
                                                                                                                                                                                    Entropy (8bit):6.398049523846958
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
                                                                                                                                                                                    MD5:2191E768CC2E19009DAD20DC999135A3
                                                                                                                                                                                    SHA1:F49A46BA0E954E657AAED1C9019A53D194272B6A
                                                                                                                                                                                    SHA-256:7353F25DC5CF84D09894E3E0461CEF0E56799ADBC617FCE37620CA67240B547D
                                                                                                                                                                                    SHA-512:5ADCB00162F284C16EC78016D301FC11559DD0A781FFBEFF822DB22EFBED168B11D7E5586EA82388E9503B0C7D3740CF2A08E243877F5319202491C8A641C970
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...^.}`.........." ......8..........<).......................................K.....:FK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\ffmpeg.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2028032
                                                                                                                                                                                    Entropy (8bit):6.64708834859118
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:x+QrVq8lxXjKAri3/8XLpvdZ4RAfdDY0K1w/cjWsdSJNTtMfxTCC:pdlNBfXt16RsFY0K3jWsdQVtM0C
                                                                                                                                                                                    MD5:5FFF6F0423A38BFAF174CB670650F4F9
                                                                                                                                                                                    SHA1:13ECD1C4784A5A178A998E9FC0DC08F556121712
                                                                                                                                                                                    SHA-256:D4E6FC4E1BC6CB5B3EF7010E61D3A65E97804FB20346CEE657688339075B2727
                                                                                                                                                                                    SHA-512:E6FF0EA9F6196470F6E094D0AB655FB527C28FC2B2A5D126A10C1F4185C0DFF5ED4F19E7ED717D67DF324562B7AA56ED87AA0BD396A6BA722D3141B9F30FC41B
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........D......0.........................................c...........`A.........................................T.......Z..(.....c.0.....b..|............c..2...<..8....................;..(....<..8...........8^..`............................text............................... ..`.rdata..\7.......8..................@..@.data....D......"..................@....pdata...|....b..~..................@..@.gxfg....,....c.....................@..@.retplne.....@c..........................tls.........Pc.....................@....voltbl.8....`c........................._RDATA.......pc.....................@..@.rsrc...0.....c.....................@..@.reloc...2....c..4..................@..B................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\icudtl.dat

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):10717392
                                                                                                                                                                                    Entropy (8bit):6.282534560973548
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
                                                                                                                                                                                    MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                    SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                    SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                    SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\libEGL.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):454144
                                                                                                                                                                                    Entropy (8bit):6.3485070297294985
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:yLSe7mxAked1dLX9ValhL1IA9SbD/9PAE:yExAkedHLX9VC9OKE
                                                                                                                                                                                    MD5:7255FCCD39F330CA2123F380B4967E0A
                                                                                                                                                                                    SHA1:C8E0E1A3E129DF7AB8922F039FFDBBA20DFBA8E2
                                                                                                                                                                                    SHA-256:22C2E5452FB01513C331B9E88313830C96EB3E554FAB942AFCBD6FB8702DF730
                                                                                                                                                                                    SHA-512:ECD66B0A43AEFD2C4721CD574D2394A2A9069B5258E310A0FC16C3919FD2505BFE91DB2FF8E4B5C7EF0187C86B167004659D15943F5BE6DF42BBFC297FB42119
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................7....................................................`A........................................`...h.......(.......x........A..............(...L...8...................0...(....)..8............... ............................text...2........................... ..`.rdata...}.......~..................@..@.data....O...`... ...H..............@....pdata...A.......B...h..............@..@.gxfg...`%.......&..................@..@.retplne.....0...........................tls....!....@......................@....voltbl.8....P.........................._RDATA.......`......................@..@malloc_h0....p...................... ..`.rsrc...x...........................@..@.reloc..(...........................@..B........................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\libGLESv2.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):8058880
                                                                                                                                                                                    Entropy (8bit):6.448026576223661
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:98304:XUoMnbHa6h5CmPt75W2+G15kI6a7Xm3rC:gDTCe4rt/aTCr
                                                                                                                                                                                    MD5:6CD8726BEEFCFA69B48EAB1362A5CAD5
                                                                                                                                                                                    SHA1:F4249179B86C0A870C55E6C5A263180C77017E81
                                                                                                                                                                                    SHA-256:2636DA528EDCAEC9834255A92411BD5DA921D793825D74CEB997E336A0DBD393
                                                                                                                                                                                    SHA-512:0F6600315B0E1B5371BB39290E5417EBAA0F3C7FB47EEF32D73AFCE299722A426DD244FD3775D88FCEB6F170F16B23B099244EE825F7F8185D58F1BF28583515
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......^...........Z.......................................{...........`A.........................................2r.......s.d.....z.......x.HX............{.|...$.q.8.....................q.(.....p.8.............s.....@1r.@....................text.....^.......^................. ..`.rdata..d....0^.......^.............@..@.data.........s.......s.............@....pdata..HX....x..Z...pw.............@..@.gxfg....,...pz.......y.............@..@.retplne......z.......y..................tls....Q.....z.......y.............@....voltbl.D.....z.......y................._RDATA........z.......y.............@..@malloc_h0.....z.......z............. ..`.rsrc.........z.......z.............@..@.reloc..|.....{.......z.............@..B........................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\af.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):502905
                                                                                                                                                                                    Entropy (8bit):5.409605383978337
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:Mqyim2uho5EnirXKhaG1B2+H2JynyaH4IFzZo0vgElgA2W0PSq+2ss30fzO75g6p:U2uhounkXyd1B2+H2JynyaH4IFzZo0ve
                                                                                                                                                                                    MD5:8032CB8A1B40AC85ACBEAFD6514BE668
                                                                                                                                                                                    SHA1:EE15C360BD913FFEC94E9E36224548CA83B2564C
                                                                                                                                                                                    SHA-256:1762EB36E254C02A50ED089ED737235FD7A64C0D234581612ACA56F6398CAC97
                                                                                                                                                                                    SHA-512:956241DA1EE60C648417C6BF3921554F1F19AB17163DBDA764AE0DC21E1729C9357BFB900B1F948D2C649F9D53DA7CEFF3128B8CFAB34FD03053A8C37C663F5D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z.................................................................Y.................&.......................).................H.....]...........#.....X.....q.................9.....G.......................*.......................4................./.....L.................:.....L.................6.....E.................T.....j...........R.......................G.....d.....u.................,.....9.............................I.......................?.......................%.....m.......................6.....].....f.................(.....1.................`.....w.................:.....R.......................5...............................................P.............................~.......................~...................................p.................] ..... ..... .....!.....!.....!.....!....."....Y"....}"....."....."....9#....d#

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\af.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\am.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):813426
                                                                                                                                                                                    Entropy (8bit):4.915984741122479
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:dTZog2ule8/xHT9KG3Sj+KRRz0l85X9icV03OzP+Xx30jH8+j:/ogg8/xpKGCj+KRRz085X9icV03OzP+W
                                                                                                                                                                                    MD5:7B88BD642C86EC4D4FB9A5614D1DA63F
                                                                                                                                                                                    SHA1:92CF23267B78039E2413F7F7F90E6636614A0C5C
                                                                                                                                                                                    SHA-256:0C1DE970426BA291B10CD08FF0E6B078ADF4C1D07B24E0D89D9322FD2EC2E296
                                                                                                                                                                                    SHA-512:17E2381491A8844D1AD6910C3876C817ADE5CF2DAD8461771BAE9E967F7F64954917E20F8258CE6548AF1C21F8CF7E9477C7BCDCE6DD216140BF4D32410A31D9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........?&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................0.....O.....$.......................u.....-.......................i................................... .................\.....o...........h.................f...........7.....g.....J...........\........... .............................\.............................r...........l.....+.................Z.......................z...........".....5.................B.....U.......................?...........o ..... ..... ....r!.....!....Q"....g".....".....#.....#.....#....l$.....$....6%....F%.....%.....&...."'....H'.....'....;(....u(.....(....!).....).....).....).....*.....*....C+....\+.....,.....,.....,....E-.....-....'.....`............/...../...../.....0.....0....A1.....1.....1.....2....`3.....3.....4.....4....y5.....5.... 6.....6.....7.....7.... 8.....8.....8.....9.....9.....9....p:.....:

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\am.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):822020
                                                                                                                                                                                    Entropy (8bit):4.925237393732045
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:vFB3t9DiYK8a4HHFLrgOIPcd1CyWpQ5fuiDbmpQ:vn3t5SzU5fu+
                                                                                                                                                                                    MD5:621B390B8AF0C70D682715323A92B61F
                                                                                                                                                                                    SHA1:C34B2F2C91CD0786FEBBD26223D1CB096A87C1F4
                                                                                                                                                                                    SHA-256:729B677BE93020DDEF1297869CA7378D3A102927294C634A1087D63F48FB8A79
                                                                                                                                                                                    SHA-512:E55691ED5FBCEF7AA8330CABDA72E9D803E12784B661A42FFE3FF725FE663AEF62EED407FDC2269135437AB7AE047A6F0CCEAA90F2349073E554DD45C5F9D0BC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................3.....N.....j...........].....!.................t...........p...........S...........}...........R...........J.....q.............................x...........H.....a...................................n.......................4.................A...........%.....A...........q.......................g.............................&.....G...........D.................!.............................A.................^ ..... ....R!....j!.....".....".....".....#.....#....,$.....$.....$....2%.....%.....&....5&.....&.....'.....(....E(.....(....P).....).....)....W*.....*....%+....R+.....+.....,.....,.....,.....-......................D/...../...../...../.....0....:1.....1.....1....o2.....2...._3.....3....s4....J5.....5.....6.....6....Y7.....7.....7.....8....'9....}9.....9....!:.....:.....:.....;.....;....M<.....<

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ar-XB.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ar.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):897122
                                                                                                                                                                                    Entropy (8bit):4.928723053414015
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:CIPFaBsPG/d/RXZwRq4fvPU7XUUk/K58N0j+JzIQ4pF:CIvAAC5h+c
                                                                                                                                                                                    MD5:3C8E3C5B1D029E9A01943DDBA053C37F
                                                                                                                                                                                    SHA1:785EE0C46B11A19C80770F2B310057E59D90C2E1
                                                                                                                                                                                    SHA-256:98CD654847FF28C0EE580A7374276EE5BD2A38DDE8F45ADFBACBD7917E4C026D
                                                                                                                                                                                    SHA-512:DCA2FC0BE678BEBF047DBAA5A71C01AD57F9B463E3F80DBFABC0937BCFDCEEFC8AE84FD415C40D0B6B713FFF24CEBFB84373ECDDE3741F78265E082C5B9951D0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%Q.e.>...h.B...i.M...j.Y...k.h...l.s...n.{...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................%.....-.....4.....;.....B.....D.....I.....b...................................o...........,...........#.....E.......................0.......................$...........?.........................................x...........\...........\...........n...........s.....C.......................(.....{...........J...................................4.....s.............................r.................1...........;.....{...........K...... ....u ..... .....!.....!.....!.....!.....".....#....r#.....#.....$.....$.....$.....$....w%.....%....C&....X&.....&.....'.....'.....(.....(.....)....C)....i).....)....d*.....*....C+.....+....:,....X,.....,....{-.....-......................./.... /...../....C0.....0.....0....91.....1.....1.....2.....3.....3.....4.....4.....5.....6....e6.....6....+7.....7.....7.....8....g8.....8.....8.....9.....9....k:.....:.....:.....;

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ar.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\bg.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):927865
                                                                                                                                                                                    Entropy (8bit):4.686646990438899
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:4Tax7YKC3cquMMLYzzQkECPUwVbtbHp373ZL+3aAKHkVDYyKzumpod2nm5g0XuGq:W8C3cquMMLYUKUwVbtbHp373Zq3arkV8
                                                                                                                                                                                    MD5:27C55B97D549BCF13145EC75F0A503CA
                                                                                                                                                                                    SHA1:4D7BEC85366FBB602EB6FC02297FB402BD40B6BF
                                                                                                                                                                                    SHA-256:F2EB47878B5D34589A2AFC2E74AB346003BF4D2C450230B9CFD084935BB54A4D
                                                                                                                                                                                    SHA-512:CA3ABB2403B8A67A53F2156E11C361B137F45378737E39D45D5F77148FF3CD031E37DB9EA144B76749667CBA20698C2049E86CA5927475B1E22112751B9BDF3F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........$&).e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z................................................................. .............................K...........................................................V.........................................^...........p...................................&.....n.....X.............................L...................................I.....\.....5.......................E ..... ..... ....R!.....!....5"....]".....".....#.....#.....#.....$....?%.....%.....%....h&.....&....<'....['.....'....n(.....(.....(....g).....)....#*....I*.....*....|+.....+.....+.....,.....-....}...........Y/...../....'0....W0.....0...._1.....1.....1.....2....w3.....3.....4.....5.....5....06.....6....L7.....7.....8....A8.....9.....9.....:....8:....&;.....;....;<....p<....`=....;>.....>.....?.....?.....@....7A.....A....LB.....B....?C....wC.....D.....D.....D.....E.....F.....F....hG

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\bg.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\bn.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1193463
                                                                                                                                                                                    Entropy (8bit):4.299730648702171
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:o3d2APzZl1uPXdf826YBWviytaGHFGuzhr0Ylf14/QISydDbrK8VBbFKQg51lNDS:o3d3Fl18fPAtt1MFSydHrK8VBbG5llA
                                                                                                                                                                                    MD5:7351AE61AE5884088AE68CE5BE0043D8
                                                                                                                                                                                    SHA1:DBEEA5DA228F63A405548F0E6F82FBBB3D624058
                                                                                                                                                                                    SHA-256:D367339A1AC5CE27E58AA03D33E567C06C02F4AC87DB26ACA5D8A3D915AAA01A
                                                                                                                                                                                    SHA-512:85D5D0372C162DE8660B4A8A4EC493585C6C3D29F999F1734C319532DB572A13C91C87320BE139F9FFA957ADD52CDC36584226FAF5AFC39F8A82A2E9C146156B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.'...w.4...y.:...z.I...|.O...}.a.....i.....n.....v.....~.......................................................................Y.................I...........z.....Q...........*.....O.....I...........F.....>.............................G.......................G.............................Q.................t...........Z.....I.............................K.............................]............ .....!....Q"....."....n#.....$....L$.....$....'%.....%.....%.....&.....&....H'....{'.....'....~(....-).....).....).....*....(+.....+.....+....s,.....-....g-.....-....5...........!/....D/...../.....0.....0.....1..../2....K3.....4....^4....X5....'6.....6.....6.....7.....8....L8....|8....J9.....:....w:.....:.....;....d<.....<....s=....->.....>.....?....??....$@.....@....-A....eA....hB.....C.....C.....C....)E....}F....pG.....G.....H.....I.....J.....J.....K.....L.....L....0M.....M.....N....7O....fO....lP....@Q

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\bn.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ca.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):573774
                                                                                                                                                                                    Entropy (8bit):5.391859865204477
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:gQQL7QREpAp973K5PqF4N3Mw2juwHzejm0t3lvqbETX9/RSHhIsjcmlLEYuCJkdz:hb9zaBRnvWDMN8UpOO5k/mVb
                                                                                                                                                                                    MD5:F6E50323E0C5A657EBDC2FE7285C15F6
                                                                                                                                                                                    SHA1:944356D207A7962A81801BB76B0E2C5226FF7F1E
                                                                                                                                                                                    SHA-256:DE474CF24B68B6D862C96B8057EDE3F53C6F63C46532E4988E9D1979B1CF59DA
                                                                                                                                                                                    SHA-512:8BC4EA1E2EB03E0423A7C3008BF6001B904928B5B7D7E84D61469C8D8CDBD34E9A4FFFA900B7CBF4216FBA3A469D7A26AF9C22E618902C28044F426693B09EC7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........"&+.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.................................................................9.................3...................................n.................P.......................T.......................K.....~.................y.................n...........$.....J.................^.....r...........,.....c.....w...........U.................Q...........5.....[.................<.....X.......................(......................................... .....5.......................1.............................[.......................>.......................^.................0.......................3.......................V.......................t.................Z.................. ....7 ..... ..... .....!....(!.....!.....!....6"....R"....."....w#.....#.....$.....$.....$....0%....Z%.....%....)&....\&....|&.....&.....'....='....P'.....'....((....h(.....(

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ca.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\cs.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):583431
                                                                                                                                                                                    Entropy (8bit):5.838398613999325
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:eV2UufpvPlAhTbe65aU8rwsiNOA3SzmPN:eV2UufpvNAhHh5aU8rvYOrzmPN
                                                                                                                                                                                    MD5:7F1AD2897B210C4C25CFBDF0736F6809
                                                                                                                                                                                    SHA1:62E0335A63BC9E2AE8A9826E08256B00E433D9F5
                                                                                                                                                                                    SHA-256:E0826C8E2FE737307D09D808BC693A397E0F1E093AC249B24CEB48327685A4A4
                                                                                                                                                                                    SHA-512:C656B1FF7FCD93B3AEF5FC9E91373D0588520546EAF6CB5E2F965FD66ED0D60E2C04FB22155723D6EFDFDB377EF98CD6420F9944C5B0FC4AE8DE14C830A05B15
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&;.e.j...h.n...i.v...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.1.....9.....>.....F.....N.....V.....].....d.....k.....l.....m.....o.............................T...........G.....e...........).....^.....m...........p.................V.......................{.................$.....w.......................z.................7...........H.................$.......................N.......................w...........2.....G...........B.......................Q.....n.................*.....V.....h................./.....@.................F.....Z.................R.....d.................9.....F.................H.....[...........*.....d.....x...........m.......................`.....{.................0.....Q.....p...........7.....c.....y...........Y.......................w.................. ..... ..... ..... ....I!.....!.....!....."....t"....."....0#....B#.....#....T$.....$.....$....2%.....%.....%.....%....<&.....&.....&.....&....@'.....'.....'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\cs.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\da.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):530651
                                                                                                                                                                                    Entropy (8bit):5.44607278354406
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:QnPhyMLsqSAzVWgss5sbse814eBjtwlRDdJwL2obEXZaFRQ5gk2rp/b3d4nTGqF5:WDgxsJjiT55g/r2Tpj
                                                                                                                                                                                    MD5:9D6A98D53208092F687AD7BB3DBAED7D
                                                                                                                                                                                    SHA1:161D0689CA85147B356167F98EAD84783E331986
                                                                                                                                                                                    SHA-256:04BF402123BFA1C7E256A62A666C0488A42ACEB585C1A9A744341EBC6FDD9A7C
                                                                                                                                                                                    SHA-512:B85832A3DBF5C97870683A655E2CB0F00C04DA4907644561894BB34DE9756334E60CAF75F0CB42E43692BF00C5EF3CFBE6D2E8F7802FFED8E6948757D2DE3E5A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................\.................".................@.....X...........d.................1.......................1.............................x.......................y.................<.......................w...........#.....6.................C.....W...........`.................]...........5.....[.................8.....J.......................#.....q.......................\.......................b.......................[.......................?.......................!.......................-.......................t.......................X.......................3.......................0.......................n.......................n............ ..... ..... ..... .....!.....!.....!.....!....:"....H"....."....Y#.....#.....#....%$.....$.....$.....$.....%....d%.....%.....%.....%....O&.....&

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\da.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\de.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):571551
                                                                                                                                                                                    Entropy (8bit):5.489447532911186
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:if1WFbCgp1nHaxa03K7UpKD93g/ahmOC2GzV6wAXaOV5jbt5sRqJoUaM5QIBCAL:wQAgnp03K7Up4g/a01JE3t5yUfvBCAL
                                                                                                                                                                                    MD5:851D55585CBC90143DD4C70EB4900574
                                                                                                                                                                                    SHA1:DA5DBD04CFEFE63D1DB69D7C6E19DAC34F379C39
                                                                                                                                                                                    SHA-256:DDBAFE037C6E7509650373D084BC0F198D3ABB7BFD93FAEDD5595F1B354EDC32
                                                                                                                                                                                    SHA-512:B1718430F3540F2455E93A1F6C47E92D7FEA99A9943E8C585EBD4DD807B5A4C1172BBDC83D434EE806C5FC3875B60D7EBDEB933D1CDE6DB50DCED9C0DAAFCD04
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.........................................................................................................................{...........;.....P...........H.................).......................e...................................:.....N...........T.................=.................!...........".....\.....m...........o.................V...........<.....V.............................z.................".................%.....7.................6.....G...........T.................!.......................S.......................|...........&.....5...........'....._.....q.............................w.......................q.................. ....o ..... ..... .....!.....!....)"....b"....."....."....c#.....#.....#.....$....}$.....$.....$....H%.....%.....%.....&.....&.....'....b'....l'.....(.....(.....(.....(....e).....).....*.....*.....*.....*.....+....)+.....+....(,....`,

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\de.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\el.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1016551
                                                                                                                                                                                    Entropy (8bit):4.766567786580532
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:WStxYcxPdGgxh1hxFFiL9+YJXDsSaSmqHuuD2Np6P4j/MAVH8yeVd85tRDQr3egJ:TtxYcxPdGgxh1hxFFiL9+YJXDsSaSmqv
                                                                                                                                                                                    MD5:F497F06BC0430F2FA1E2BFFC32E2B9C5
                                                                                                                                                                                    SHA1:38141C3F85FD4A8FCF2A82B0DEB68BD93F062F60
                                                                                                                                                                                    SHA-256:B3CB15115252BBF1363B7231ED32309C9E2E5B6EEEC1B2BBC2700A49A26E56D0
                                                                                                                                                                                    SHA-512:C455DE6466A9FA535C685163A6B4540DC00EB51CC5565ADDFB0E124E3A29CD4AFEC7AB9DF7848C9D3A6C7F435E1CC761F74D8F162D8BC7378D086E96EFA2E705
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........%&(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.(...y.....z.=...|.C...}.U.....].....b.....j.....r.....z...........................................................R.....y.....W...........C.....>...................................X.................C.......................O.................k...........J.....j.....9...........X.......................(.....b.....4...........s...........u.....1.......................z...........0.....d.....\...... ....I ..... .....!.....!....!".....".....#.....#.....#.....$....<%....|%.....%.....&....m'.....'.....(.....(.....).....)...."*.....*.....+....1,....X,.....-.....-....'.....N....../...../....#0....D0....O1....W2.....2....%3.....3.....4....!5....V5.....5.....6.....6.....6.....7....(8.....8.....8.....9....Y:.....:....-;.....;....|<.....<.....<.....=....l>.....>.....>.....?.....@....!A....PA....zB.....C....KD.....D.....E....lF.....F....&G....6H....2I.....I.....I.....J....iK.....K.....K.....L.....M....zN

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\el.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):459985
                                                                                                                                                                                    Entropy (8bit):5.5152848417450615
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:HAeAGZgSZ+XKFELrqmjLCd3MP9ej7HXfaYISMv5n5CSEBcWRnFc:HjfZgseoEL5C3Ma7H6N5CSgc
                                                                                                                                                                                    MD5:F8EEEBF6B363D8578D769AA05FED5BA7
                                                                                                                                                                                    SHA1:12E8B6FE48CA49936769B766A9A13510D9569A20
                                                                                                                                                                                    SHA-256:1F7D3BEACD2A55F3BF2D3571BEF1D05FA333FADD9E6CA141C2525B0678824CDD
                                                                                                                                                                                    SHA-512:3AAE1B6881E50E88635336218D7C13ACF81687AD78FB902900746EB875D9DD29DBF83A1D51344DF617DD86E31BAAD04564460ECC48886308E742830412E8C71D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&..e.`...h.d...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....n.....{.............................~.......................|.................$.....}.................(.....t.......................J.....s.......................5.....B.............................v.......................l.......................H.............................^.......................^.......................*.....E.....T.............................8.....u.......................J.....|.................&.....S....._.......................!.....i.......................).....n.......................[.......................:.....].....s.............................{.......................J.......................1.....h.......................;.....j.....z.................W.....o...........B.......................X.......................N.....z.......................4.....D..................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-GB.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-US.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):464664
                                                                                                                                                                                    Entropy (8bit):5.505055040425703
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:V0BSJCCPeiISZuw3jcMP9eD3D9faYLbcNx5FSZngP/eXywB:8SJDPeDIjcMY3DzA5FSHywB
                                                                                                                                                                                    MD5:4B6300C27E7575C32888C1F3364D5346
                                                                                                                                                                                    SHA1:C5F5E1D3524ACC96FB4E18C08B02F54ABF83C3D4
                                                                                                                                                                                    SHA-256:0945C89B16D4FEBA346E85E14792B772DCC6278F7DCA7FB099A6100C93E79740
                                                                                                                                                                                    SHA-512:3F21B6F4A3E18755B355CE5F20384D549B3F723104A67C67AE521D2C4544AA3095FADA8855A0CC1A10E7C5BF3E8F55D061AB2DCEC210F76101A61D9484D4EE6F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}.............................................................................................................;.....N.................".....2.................-.....C.......................+.....w.......................<.............................E.....j.................4.....i.................".....S.....a.................#.....3.............................i.......................\.............................6.....U....._.............................e.......................F.............................V.............................>.....I.............................l.......................g.......................).....e.......................+.....M.....\.................5.....[.............................Z.......................?.......................;.......................`.......................a.......................+.....i.......................C ....t

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-US.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1031027
                                                                                                                                                                                    Entropy (8bit):5.210875521790238
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:HmdiMRfFgJWHLboEFFRyYHiLNQTCvXTOnXv1x7S6a8wGi4ADjn1VtuYtP01+Z5zp:H/sm5z9v
                                                                                                                                                                                    MD5:D5A14353A7FCC1F199F9234BD4551FF9
                                                                                                                                                                                    SHA1:7476E2846B6C0D03338A074D7FE325BB468992FE
                                                                                                                                                                                    SHA-256:E5CFEBD81831A65CA268866A8EEADB334F64FA3B0853BD550E5BB69724408FBC
                                                                                                                                                                                    SHA-512:BCE4FB535509834EA32ACBA72FC22B76CE591F9B6C1C15207B023460F59E9BC6F65118F816A82D235E7F20E26BF822EA102C95B5DA71FCFF099D56215945BD27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&g.e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}.........................................................................8.....[.............................k...........t.....=.............................f.................J.......................t.......................a.......................g.............................]...........i.............................P.......................q........................ ..... ..... .....!....."....O"....y".....#.....#.....$..../$.....$.....%.....%.....%.....&.....'.....(....[(....%).....)....a*.....*....C+.....,....s,.....,....R-..........~...........X/.....0....~0.....0.....1....x2.....3....M3.....4.....4.....5....J5.....6.....6.....7....J7.....8.....8....!9....K9....2:.....:....q;.....;....z<.....=....L=....r=....U>.....?....|?.....?.....@....EA.....A.....B....,C....8D.....D...."E....!F.....F....zG.....G.....H....dI.....I.....I.....J....RK.....K.....K.....L.....M.....N

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\en-XA.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\es-419.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):560321
                                                                                                                                                                                    Entropy (8bit):5.366866302767652
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:jjxzJ7FnfONzx0T8puYnKwoR5g6qLFYUudBm+u:nP8/pQj5g64F4Tu
                                                                                                                                                                                    MD5:AAB525A7681AE93791B283205064E2B4
                                                                                                                                                                                    SHA1:A021DBDCD3F269B77D7133F47B63906FFF794F76
                                                                                                                                                                                    SHA-256:5EF4BB4558102F2E39669208BECE79FD5B474E0A87C8A1EED5BCD6B13DA6C6FA
                                                                                                                                                                                    SHA-512:841CD903FCF716692FF1873EDAC4FEB5F8B907AFEC1D0DEBFABB39255A74B9B2096FAE3E562E95893DAC731EF46D07B12B6A441975042981CC88638B7673B435
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.*...w.7...y.=...z.L...|.R...}.d.....l.....q.....y.........................................................................................v.................i.................Z...........7.....U...........B.......................B.....l.................<.....d.....u...........o.................n...........".....L...........).....n.................V.................)...................................j.................(.....W.....r.................K.....Z.................R.....h...........E.......................a.......................W.......................<.....l.....v...........D.........................................Y.......................c.................J.......................r...........) ....j ..... .....!....?!....Y!.....!....."....O"....h"....."....5#.....#.....#....*$.....$.....%....(%.....%.....&....z&.....&....#'.....'.....'.....'....5(.....(.....(.....(....7).....).....).....*

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\es-419.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\es.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):559178
                                                                                                                                                                                    Entropy (8bit):5.34611084339133
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:tMTZMKZuHswv12Jp/bNg86ip3+UxojFtnj45vzr700Iu96PZrk8jb:AZMKUGVVLpzojTnj45brY0sb
                                                                                                                                                                                    MD5:078BD56804D26C26E9AA4F41BF6549F6
                                                                                                                                                                                    SHA1:B1B575D34769F35CF28158BCB40C92264DECC551
                                                                                                                                                                                    SHA-256:99389110A1497D3999E8CB5799A629A471D221E07C2818CEFEEDB1C95BF5A9F3
                                                                                                                                                                                    SHA-512:4108B3BDED940A7D3939EE68DD489A4453391BAE548285867B81A50217C248280111853A1EB6838B6C079A01A74D11CEE61E7F441CBC6D7BA91F1DFAE3EE602F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t."...v.7...w.D...y.J...z.Y...|._...}.q.....y.....~.........................................................................................+.........................................v...........f.................c.......................u.......................v.................7...................................V.....t...........L.......................p.................@.............................#.....q.................K.....~.................@.....h.....w...........:.....p.................R.......................M.......................:.....k.....v.................N.....X.................E.....U...........C.......................Z.......................T.....{...................................A.................1 ..... ..... .....!.....!.....!.....!....."....."....."....."....>#....X#.....#....l$.....$.....$....o%.....%....:&....c&.....&....F'.....'.....'.....'....@(....f(....y(.....(....J).....)

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\es.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\et.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):509452
                                                                                                                                                                                    Entropy (8bit):5.455817407928288
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:Z0izVKnUJ1HNRSUSx+DuM/Fb0WmFosQ4Eqsoh7Pwiw4dQH5ejnrlvCKMvaKWcEzn:vVKi7S65JmFosZtQH5ejJsW
                                                                                                                                                                                    MD5:45E28E64378FABED845EB242A8F1563D
                                                                                                                                                                                    SHA1:8FAA0651CA0D29596CA294DC448CB870D553C0FF
                                                                                                                                                                                    SHA-256:68386C75B1E414B5F94E1AA5EB9A98A42B6298177FABB834A8B9E96E1EF70A2D
                                                                                                                                                                                    SHA-512:3165EC45C2958C382832E4528D38966C28CA90C84777FD48D762FBD75F31FD52BD1B2C069BA4644504913219FAD5DDC08980F69DC67B9AB03D392AFC1321C339
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........:&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.!...s.2...t.;...v.P...w.]...y.c...z.r...|.x...}...............................................................................................................................t.................&.......................I.......................I.......................;.......................=.......................M.......................w.......................{.................'.................).....A...........6.....{.................W.....y.................=.....`.....l...........!.....K.....[...........).....c.....n...........5.....o.....}...........6.....g.....o.........../.....b.....q...........0.....d.....l...........T.......................U.....t.................H.....l.................<.....t.................I.....}.................L.....f.....w...........;.....c.....{...........G ..... ..... .....!.....!.....!.....!.....".....#....I#....n#.....#....J$.....$.....$.....$....-%....I%....]%.....%....+&....Y&

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\et.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fa.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):825360
                                                                                                                                                                                    Entropy (8bit):5.0557125829631335
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:24576:FqvG8u313uyqoT+s1qLpRmX1loT4RmdAQifaQ2XxFMJGk620dri1HMX9O9xdpxHk:Evpu55M
                                                                                                                                                                                    MD5:A13029CB1D5873121E6BDD0929A6C772
                                                                                                                                                                                    SHA1:7B88AE77DF959B8C01F5F00F2B0DFC30ED0A85EA
                                                                                                                                                                                    SHA-256:2527D1821D08E43D2F1259A1F910AF986632B8AEF9257D2FC37BC285AF7EE217
                                                                                                                                                                                    SHA-512:AF272D021316A71CF2A98126AF9CA993122B3B7B766C6D34003BCDC2FC5936BC4FAE95293B1D74FE35A0C81150D45E95ADABC4B34118974D214049FCDBEE74CA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%p.e.....h.....i.....j.....k.*...l.5...n.=...o.B...p.O...q.U...r.a...s.r...t.{...v.....w.....y.....z.....|.....}...................................................................%.....A.....k...........w.....H.......................M.......................]...............................................K.................=...........#.....D...........}.......................O.................Y...........E.....a.................................................................*.....N...........W.................,.............................!.....c.....z...................................@ ..... ..... .....!.....!.....!.....!.....".....#....R#....t#.....$.....$.....$.....$.....%....I&.....&.....&....L'.....'.....'....!(.....(....h).....).....)....}*.....+....j+.....+....>,.....,..../-....u-.....-....k.................e/.....0....a0.....0....&1.....1.....2....%2....#3.....4.....4.....4.....5....N6.....6.....6.....7....98.....8.....8....39.....9.....9.....9.....:....G;.....;.....;

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fa.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fi.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):517467
                                                                                                                                                                                    Entropy (8bit):5.424845538875905
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:RKUtqd19KJOKu4ar5HZ7kfCHEpyWaZ7WYM:Ntq8S5HFHAl
                                                                                                                                                                                    MD5:E7B72F44D711DECE8E3043173A553AC4
                                                                                                                                                                                    SHA1:892424E4E011AAC47B068F9FD929B5E41BCCA525
                                                                                                                                                                                    SHA-256:5F1A9DF87400AF56F748026F3BAAA41756A4C42FCE4791AABFE2087441689340
                                                                                                                                                                                    SHA-512:A2907B8E12CCDD0FC5601C37F23CCD5556B4EAE18CB1833481D01B39B30EC643167B0C8295EC9EE8CE851B0C7968E83F9C47C6E1D4543A371A62485D1832835A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................'.....@...........E.......................s.................(.......................O.......................Y.......................7.............................\.........................................9.......................5.......................8.......................X.................&.............................[.......................!.....k.......................;.....e.....o.................N.....[.................#...................................l.......................a.................0.....~.......................K.......................A.......................?.......................I.............................f.......................^.................7.................................... ....2 ..... ..... .....!.....!....p!.....!.....!.....!....7"....."....."

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fi.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fil.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):584976
                                                                                                                                                                                    Entropy (8bit):5.195604084490558
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:4ln56kcajNxYUC36tIQy7DQEuq2V8L0dnGNLmG5eXmi1YARFtK:KnAkcmqnxEG5omt
                                                                                                                                                                                    MD5:F7F3CC17509AF03E639E983A091C2026
                                                                                                                                                                                    SHA1:D36E61E50B5FA99BE2A3C3727AFEB142969C8308
                                                                                                                                                                                    SHA-256:5D586C9BFA38452CDFB50BF5D2E9B98E68A8E7CC73E4D641D8FD6BB3E7EC5712
                                                                                                                                                                                    SHA-512:5A2C037D0AFDC82A4ECA642F43CC10E0040B7F97BE9DA14A8F806970C1E07BEC9CD69AD816A91A41946F35FF7A760ACC65DF21F6CD9D365ACBBA345FF0C1FF70
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~...................................................................................-.................(.............................4.................5.......................h.......................u.................+...........+.....i...........+.................#.................[.....q...........[.................1.............................5.......................s.......................i.......................R.....|.................h.........................................&.......................(.......................).......................M........... .....=................./.....M.................. ....! ..... ..... .....!....2!.....!....'"....n".....".....#....l#.....#.....#....&$.....$.....$.....$....j%.....%.....&....A&.....&....u'.....'.....'.....(.....)....S).....).....)....d*.....*.....*.....+....j+.....+.....+....",.....,.....,

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fil.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fr.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):606342
                                                                                                                                                                                    Entropy (8bit):5.380118288987104
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:n2sEZLqUMDpDgEL6QuaMVWXKz05qlZQmZyMYnYtkL09ujzxRe5hxkJSW7v40wCJ/:zj2VIN5JL
                                                                                                                                                                                    MD5:326917C8F37FE85E58AD3DE991D17A78
                                                                                                                                                                                    SHA1:683ED0FB95F33DC2B095E774AD3DE84B0E4A63E3
                                                                                                                                                                                    SHA-256:CFA45E5F86F70AE4D47D82BCEC6C245E618212E67CE8B7BF0A1BE0BE41C6E6E8
                                                                                                                                                                                    SHA-512:3FDF2B1C8031A06D5140449E22861545CC80E1417A70558DB2ACAC25733AC156A0D7941B053A7CFFB2ED193BBE5E0CAE4F1F68437FA570C612BE606DD10ECAE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&<.e.h...h.l...i.}...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z. ...|.&...}.8.....@.....E.....M.....U.....].....d.....k.....r.....s.....t.....v.............................Z...........z...................................k...........P.....l...........G.......................x.........................................c.................>...........).....l.................n.................&.......................\.................-...........Q................./.......................0.......................*.......................B.......................[.......................^.......................K.......................D.......................o...........S.....j...........0.....^.....|.................4.....R.................X.....t...... ..... ..... .....!....[!.....!.....!.....!....[".....".....#....!#.....#.....$....Z$....z$.....$....x%.....%.....%....f&.....&.....'....>'.....'....I(.....(.....(.....)....^).....).....).....*.....*.....*

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\fr.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\gu.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1177779
                                                                                                                                                                                    Entropy (8bit):4.338116428198543
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:C3T12vbLPxCoYITYsRvc38ZUd02GHIwjAwREJKVMjNiT7llj63rhJXlPCKMi5eWt:dTbYITncQi02JCWJL5DAhc2T2
                                                                                                                                                                                    MD5:D77AEE1AB6AF4FC83813A69D3CA61E46
                                                                                                                                                                                    SHA1:C0786021AF8C8BBB083E9C4104B68BD28537893A
                                                                                                                                                                                    SHA-256:5D5E20C5F0CA21D8F1824EEBE8E595FAD4D0E601B224F4433B355A21B643971F
                                                                                                                                                                                    SHA-512:78C2589BC37594236D5B01C4C6C0CB934CF9CCAE15679159E1BCE64E3F5A3C903F9F7127D0DA8C317FD085A70EDFFDCAC413B4F2627BF14B862794B47BBA042A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........+&".e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.............................................................................(.....`.................j.................Z.................F.....).............................#.....L...................................=.......................U...............................................|.............................E.....q.....n.....i...........+.....N.....\ .....!....D!.....!....n".....".....".....#....H$.....$.....$....O%.....%....?&....X&....$'.....'....=(....h(....$).....)....?*....a*.....+.....+.....,....),.....,....}-.....-.....-..........S/...../...../.....0.....1.....2.....2.....3....74.....4.....4....;5.....5.....5.....6.....6.....7....08....V8....a9....,:.....:.....;.....;....s<.....<.....<.....=.....>.....>....)?....)@.....@....mA.....A.....B.....C.....D.....D.....E.....F....vG.....G.....H.....I.....I....*J.....J.....K.....L....4L....SM....0N.....N

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\gu.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\he.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):728589
                                                                                                                                                                                    Entropy (8bit):4.658856122190603
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:W5SDjhr3FluYMy31frspm29Wqu/kQl4JACVXbfeQCajLn5l67co+oiNB05elmmdi:W5SdY5/oP
                                                                                                                                                                                    MD5:04C846A7F65C1E95E49CFE69EC9EEB45
                                                                                                                                                                                    SHA1:78142FD5545EE76B1F90FF5DF6FB7C01D797F3D1
                                                                                                                                                                                    SHA-256:AFAFB0DADD253E7F665FCB0D9D562D243E32D774B6ABDF602B66734F310E689B
                                                                                                                                                                                    SHA-512:029F45EE02DAD7D3431B223F5516937E34D685026488BA2DBF7C43FFDEDD1240FA119C349E4F5052CA3FDE109215D6D8813A43297A7E4EDB5D9B063192AC775A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%N.e.D...h.H...i.Y...j.e...k.t...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............!.....).....1.....9.....@.....G.....N.....O.....P.....R.....i.......................}.....3.................g...........%.....>.........................................a.................x.................E...................................=.....m.........................................s...................................q...........8.....Q.......................E...........+.....V.................m.................I...........!.....8...........*.....j.....}...........s.................B.......................s........... .....3.................\.....o...... ..... ..... .....!.....!.....!....."....?".....".....#....>#....b#.....#....Y$.....$.....$....g%.....%...."&...._&.....&....''....H'....a'.....'....D(....u(.....(....4).....).....).....*.....*.....+.... ,....D,.....,....l-.....-.....-.........../....b/...../.....0....u0.....0.....0....~1.....2....k2

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\he.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hi.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1250127
                                                                                                                                                                                    Entropy (8bit):4.3103395858193565
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:AubcffOrA0yUdRSM7vyWYfbXpgTMoV/BB0ZV1d1AuxXRLiW3Jk1eTByntDPtDl+U:AuAf2E0yjUv3MlgTMJem05f5xhbv
                                                                                                                                                                                    MD5:114BBD0D21C90DDFCE1D6E26432B7B9C
                                                                                                                                                                                    SHA1:EBFC476B4D742D9FDF5D0E78996748497EB0B4FF
                                                                                                                                                                                    SHA-256:E2321752811548A92EF069E53ABE349CAA93BE5596A2579DDE65391EE7CF915B
                                                                                                                                                                                    SHA-512:6195FC185F8297CA1C38B79339F86F0788B342A90B0E98F1ED5883CBE61725000B1653E911EB749351BB74802B8E75199DCF0C95D903A4422755E809A6A1814D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%_.e."...h.&...i.7...j.C...k.R...l.]...n.e...o.j...p.w...q.}...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................%.....,.....-...........0.....R.....w.....................................................g.............................8.....+.............................6.................~...........y.................+.............................8...........^..... .......................W.......................................... ..... .....!.....!....."....y#.....#.....#.....$....b%.....%.....%....s&.....'....M'....f'....=(.....(....b).....)....R*.....+....d+.....+....3,.....,....3-....O-.....-................./...../.....0.....0.....0.....2.....2.....3.....3....x4....#5....p5.....5....76.....6.....6.....7.....7....n8.....8.....9.....:.....:....A;.....;....O<.....<.....=....]=....Q>....-?.....?.....?.....@.....A....BB....zB.....C.....E.....E....+F....9G.....H.....H.....H.....J.....J....~K.....K.....L.....M.....M....:N....7O.....P.....P

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hi.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hr.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):562949
                                                                                                                                                                                    Entropy (8bit):5.503469092776888
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:3072:5pEDgLd6TlZ/9yZuYUapEXgaBV08L7SkK7D+wwWrDfB+uhAxqOSAq6+xMcwd0uPJ:HEDjTMzU0EV7xHwPBhbKBc5ag7yIjR/K
                                                                                                                                                                                    MD5:54308E58D399D0F1C4E66A4A4B6E3B59
                                                                                                                                                                                    SHA1:8DFCE74D45801654531C78E34CF6A6C2E4BA5556
                                                                                                                                                                                    SHA-256:8141D126CD8ED7CD29B998E4A778E81AEC043BC126B5D2B0FB62F95C5FBF1F62
                                                                                                                                                                                    SHA-512:33C74ACE0F430D2E7963512075007DCA70ADCDD43FCE31A27F925351CEB00CFECE329EC5E9B60DACFF7E28DA322FC9CEFF3FCD9AE3A7BB6655400F1A580C3EA2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........F&..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.......................................................................................................C.................0.......................c...........#.....B.................R.....h...........".....T.....d.................2.....B.................G.....l...........i.................D.......................k...................................L.....g.............................e.......................C.............................U.....v.................I.......................D.....r.................L.......................A.....l.....|...........'.....T.....d...........T.......................Z.....|.................@....._.................(.....U.....l...........K.......................m.................. ....u ..... ..... ....G!.....!.....!.....".....".....#....t#.....#.....$....n$.....$.....$....9%.....%.....%.....%....'&....p&.....&.....&.....'....|'.....'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hr.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hu.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):605952
                                                                                                                                                                                    Entropy (8bit):5.638270541961174
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:n0L6iTfLsgtbgq0LcP9wHs8DfcAujkatvV5RvBFZfpduYG3b7ZNIeHK9njDi59Rj:iTfrtcFQA0V5RvBn0zzKY5u0vv
                                                                                                                                                                                    MD5:B7AA52653BBABCC713A03067E6FCFCC3
                                                                                                                                                                                    SHA1:B18CC0B968C4C0F156E33F5C493E6C09760161DD
                                                                                                                                                                                    SHA-256:244BE241E2FD68882ADB0C1A1C4AE93B1406AE22CCC14BCB37FC09FE3C2831A5
                                                                                                                                                                                    SHA-512:CB393247F79F1A6CDD685AD9729D0C7FD3BFADB5591CD822A4F92BA19448E50C148517DC0DDC14C37243CC0145A5AB17D27C45CCEBDCCB76CEC70C1B444D07C0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&L.e.H...h.L...i.]...j.g...k.v...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............#.....+.....3.....;.....B.....I.....P.....Q.....R.....W.....g.....}.................T...........u...................................f...........L.....f...........^.........................................(.......................{...........-.....^.............................s...........(.....:...........!.....c.....s...........v.................k...........W.....v...........j.........................................).......................q...........M.....d...........n.................>.................+.................W.....l...........r.................C...........(.....>..........." ....I ....e ..... ....0!....\!.....!.....!....L"....."....."....4#.....#.....#....&$.....$.....$.....$.....%.....%.....%.....&.....&.....&.....'....c'.....'.....(.....(....%)....4).....)....[*.....*.....*....s+.....+....:,....V,.....,....$-....U-....q-.....-....b.......

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\hu.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\id.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):500354
                                                                                                                                                                                    Entropy (8bit):5.374540321275158
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:HDTG/Veh932Bmcwf/yG+wFZf+MVnjHF3mmi8IxZ5GZhWwkK5cTSzo7IEji4JHw:HHG8h94sXyMFTVnjHFWmNIb5GZhow
                                                                                                                                                                                    MD5:0EFA0011CE0365AE4AFC08753F559098
                                                                                                                                                                                    SHA1:6AFC5115DFC222F0F2B2265A591B571803787DCA
                                                                                                                                                                                    SHA-256:A780C4E8E48CBDF2064CFF3E9E025103739B3763E3B82DDD99C97DFFF8FB1CE2
                                                                                                                                                                                    SHA-512:21C34901F5260606F14FE0E004851AF4DFA6960C28872417FB995ADAC4B2652609D9C0F5F30C0F76F4287217ADCDC0ACF1545CBD4E5A6F4B15565668840BCB75
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................@.......................`.......................Q.......................m.......................p.......................N.......................8.......................@.......................4............................._......................._.................!.......................(.....e.......................$.....I.....U.......................!.....|.......................c.......................>.............................e.......................L.....~.................?.....u.......................(.....9.............................b.......................C.......................'.....c.....}.................=.....k.....z...........6.....r...................................Y.......................l.......................B ..... ..... ..... .....!....q!.....!

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\id.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\it.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):558299
                                                                                                                                                                                    Entropy (8bit):5.272942823509238
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:qrF11tFO6w7oWhI7xO2/IJ/jNLiISIqRRRsO1StiRT9TjexKqcQxLcaPpzHi9fLN:u1tFFehoXFZxR8g26sjoh59koF
                                                                                                                                                                                    MD5:12FFE0FC0BE1B4134F219BD3B6D8F550
                                                                                                                                                                                    SHA1:DC14159AEA6643FEED260C3E3EB9BF4286FFFD9C
                                                                                                                                                                                    SHA-256:4FFAADC42BB0F78B78061EEC23B39BEBF34BA3B9B4F2CD0415FD3C94B2C828D3
                                                                                                                                                                                    SHA-512:423EB3AA074617C8FB64EA909CF860C8706B73B5CBC97D85D21E9298DC53CF9451DECCB1DE45B19377E8E2461D78282D587264340BCE8F487AD48B0DDEE55123
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.........................................................................................w.................X.................2.................'.................g.................(.....O.....].................$.....3.................L.....v...........n.................X.......................y.................".................?.....X...........R.................'.....s.......................W....................... .....G.....R.................\.....n.................J.....U................. .....).....x.......................Q.......................Z.................,.............................U.............................d.................(.......................c.......................>.....|.................J ..... ..... .....!.....!..../"....."....."....<#.....#.....#.....$.....$.....%....W%....m%.....%.....%.....&..../&.....&.....&....:'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\it.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ja.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):677279
                                                                                                                                                                                    Entropy (8bit):5.7261443457831875
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:5mNTLdjIcq5eHWv0WSGRBZ6Q2T+NbX5+Fo1Vi:5mNTxqe2ccBZ6Q2T+h5+FF
                                                                                                                                                                                    MD5:A92DA679A63FB99BB5F3BCF829168D21
                                                                                                                                                                                    SHA1:F15AA9BA6A952490DD881C82DED179FE03E50E80
                                                                                                                                                                                    SHA-256:F78FEB7523A3B4C795AC02EB66FD455B0F490257549D681B7AA07255E99AB9D9
                                                                                                                                                                                    SHA-512:3055528033206B6F32371A1BA05633614C0A3A9AF4FE2326FA3E6689BF535D5D540D926E08963FB668B02EEFF216DC2ECABED035C821C83E5D96CD2ED1531835
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........e%..e.....h.....i.....j.(...k.9...l.B...m.J...o._...p.l...q.r...v.~...w.....y.....z.....|.....}.....................................................................................1.....O.....p...........+.................'.................Z.....r...................................|.............................9.....K.................F.....V...........R.................@.................%.................8.....H...........#.....T.....c...........D.....{...........3...........5.....P.................6.....R...........S.................A.................*...........d.................`...........2.....A...........=.......................}.................P.................1...........j.................j............ ....: ..... .....!....Q!....r!.....!....^"....."....."....f#.....#....*$....d$.....$.....%....>%....M%.....%....R&.....&.....&....''.....'.....'.....'....z(.....).....).....).....*.....*.....*.....+.....+....1,....w,.....,.....-.....-.....-.....-....k...........4/....O/

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ja.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\kn.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1341496
                                                                                                                                                                                    Entropy (8bit):4.250874916501427
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:v/9cYunn57Dz6f03QIBR0UInI7L5IazUG4pt+h9lcQ:nCYu5i25PUS
                                                                                                                                                                                    MD5:F13C1631BB1E180C07CB10C5142CEC74
                                                                                                                                                                                    SHA1:BD3B971893D3CE2206EDD040ED0EAB9BA010BD18
                                                                                                                                                                                    SHA-256:3A63D9B5BDECE8442ACA6971771A660BCEAE995CA96394FA88B024FEF3C93BF7
                                                                                                                                                                                    SHA-512:9122A55CE0E09ADAFE0162337B518228441D9A852E68761BFB62B656415F25386B3DB41279699F8035BE3BB3EA003FCBA91B5D5FC6EC538EF79E9486A488280A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........M&..e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.........................................................................(....._.................j.......................A.....I...........X.........................................]...........Y...........P...........q.....:.............................q...........2.....A...........y...........S...........".....1 .....!.....!.....!....)#....?$.....%....Q%.....&.....'.....(....@).....)....r*.....*.....*.....+....@,.....,.....,....U-.....-....>.....S.....6/...../....w0.....0.....1....?2.....2.....2.....3....B4.....4.....4.....5....p6.....6.....7.....7.....8.....9....@9....b:....a;....!<....P<....3=.....=....Q>.....>....>?.....?.....@....,@.....A.....A.....B....`B.....C....PD.....D....eE....MF.....F....RG.....G.....H.....I....'J....yJ.....K.....L....TM.....M....(O.....P.....Q.....Q....8S....6T.....T....lU.....V.....W..../X....|X....IY.....Y....\Z.....Z.....[.....\....]]

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\kn.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ko.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):569413
                                                                                                                                                                                    Entropy (8bit):6.084713993678112
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:OA7Ny//OV2Ngi7QFIyjxMSVG0GTin8t8OQ4E3hvaYrSCqD5tEp7YqGT8U13Xq7hy:OA7Ny/oZO5L8frCT
                                                                                                                                                                                    MD5:E8448C3D352C76C1C0F2B9F508852D9A
                                                                                                                                                                                    SHA1:2B7FE9F0A49FE3428E467A4214D0E7EC79CF7B52
                                                                                                                                                                                    SHA-256:30D515F2E086A7773DD3C7B5E6504729B6D91D9FA7174C3226EB3553F900BBF2
                                                                                                                                                                                    SHA-512:AE4144323E7EB2C2C97F336EE144C0C739CB5500F7FF382469CB4CE33DBAE35078EACD85F50381912C9D4367DFC9CBCB6C7C7BCE8314A0351B14F950A2209184
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........>%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s./...t.8...y.M...z.\...|.b...}.t.....|.....................................................................................................A....._...........8.....y.................p.................3.......................Q.......................V.......................e.......................v.................+.......................!...............................................+.................{.................D.....h.................%.....J.....Z.................%.....5.................W.....s...........7.....k.....{...........B.....v.................E.....u.................C.....t.................y.................:.......................*.......................5.......................O.................#.....t.......................?.......................B.......................U............ ....& ..... ..... ....0!....G!.....!....."....>"....Q".....".....#....$#....7#.....#.....#....($....;$.....$

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ko.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\lt.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):611429
                                                                                                                                                                                    Entropy (8bit):5.6299671018290445
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:QQtetgAZbMAUbgO9aG1DT/G57szII1JgNf6SMM:QDgiMQzOG55IngN/
                                                                                                                                                                                    MD5:F6F5B593C91B7820C9552FFDDFAC03FC
                                                                                                                                                                                    SHA1:D771AC14A49C7654043D0AE2DC52239BF4636F65
                                                                                                                                                                                    SHA-256:FFE7EAC4BC39085977C28BF8BA0060B9A12471C3914A30DF1C46305926242BB6
                                                                                                                                                                                    SHA-512:45D3580D456F6972259055BFFEDE8745C922DFE2703BCF3A545E73211164E3CA594A56330A2A17EC373AB060C05A7776D88DFBAB5014081948A5F89A849F793C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........&&'.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................v...........d...............................................i.................z.................D...................................?.....V...........P.................3...................................D.....U...........C.....}........... .............................&.....t.................t.................#.......................N...................................E.....X...........L........................................._.................(.................C.....Q.............................h............ ....( ..... ....9!....s!.....!....."....."....."....."....m#.....#....*$....]$.....$....4%....V%....i%.....&.....&.....&.....&.....'.....(....J(....n(.....).....).....*....!*.....*....*+....h+.....+....&,.....,.....,.....-....j-.....-.....-................./....Z/

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\lt.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\lv.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):610750
                                                                                                                                                                                    Entropy (8bit):5.626685122127425
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:IbsBLMwr28cTB6aTmNstVFpM6Y97vccj/kbO153ySAbEwT4757esFOHAYXSIENAs:FL8PXVY9rrV15SEwTW5tOmAhm
                                                                                                                                                                                    MD5:8D8244CEA7D00E7502CFC62908147BB7
                                                                                                                                                                                    SHA1:2ECF5C264208555EC5BD4530544CC0AEE99F558F
                                                                                                                                                                                    SHA-256:C9722A6B132E9EF5BCA53565BCBC2CB3C40CB8954F2286250AD15FAFC0D2DCC1
                                                                                                                                                                                    SHA-512:B5B98ADE8D7EA25477D12CBEB6B1F07FEC5625583B8CC695755195B1EEF0D380C72AE4609955D230B4FD6109AA6B778421E7EAE9D7086FEC03CFF93C93D91791
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........J&..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.....................................................................................$.....@....................... .................T.....g.........................................Y.....x...........W.........................................O................. ...........e.................H.............................&....._.....r...................................*.....z.................f.......................o.......................}.................5.................$.................:.....L...........:.....q.................i...............................................#.....u.................P ....k ..... ..... .....!.....!.....!....5"....."....."....."....j#.....#....:$....t$.....$....A%....a%....z%.....%....~&.....&.....&....J'.....'.....(....%(.....(....|).....).....)....z*.....*....5+....[+.....+....V,.....,.....,.....-....r-.....-.....-....4............/

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\lv.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ml.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1394062
                                                                                                                                                                                    Entropy (8bit):4.285571867304228
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:MYNjRdBR8QA2cMmsbbAx4LJxFq/ixn9mMy6UQ6KfUBp/AZCBEmeyo3ewhp5O47uW:RZRltMTKfUBpUyo3eo5O47xs4+3e
                                                                                                                                                                                    MD5:979090995F7F9DBFA9FA9A96349DA745
                                                                                                                                                                                    SHA1:6D9425EB6D3FF6B433A2FFD89DFFB3AEDCDE3588
                                                                                                                                                                                    SHA-256:C27AC1727F3A3A25ABED09CBF07DA604DD1C42A1855851E63DFCDC9831091EDD
                                                                                                                                                                                    SHA-512:4D734D7903DD4C39A2392EDA7B6A65929E61FE105ED843718D5CAF8D93DA9FF14A8908B896425335FCE9CA5AE717C29C80E7D85A2A6B80DF9F4FAC8F7A558F38
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........G&..e.....h.....i.....j.....k.....l.....n.....o.....p.)...q./...r.;...s.L...t.U...v.j...w.w...y.}...z.....|.....}...............................................................................b.................T...............................................c.................................................................\.....M...................................8............................................................ .....!....s".....".....#.....%.....%.....&.....'.....(.....)....2*.....*.....+.....+.....,.....,.....-....".....P....../...../....40....h0....J1.....2.....2.....2.....3....I4.....4.....4.....5.....6....#7....W7....C8.....9.....9.....9.....:....i;.....;.....<.....=....?>.....?....C?....-@.....@...._A.....A....\B.....C....PC.....C....nD....;E.....E.....F....BG....*H.....H....HI....,J.....J....TK.....K.....L.....M....NN.....N.....O.....P....IQ.....Q.....R.....S.....T.....T....&V....-W.....W....=X....kY....fZ.....[....Y[....J\...."].....].....]....+_....:`.....a

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ml.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\mr.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1147816
                                                                                                                                                                                    Entropy (8bit):4.319695697825778
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:p+xh0ke1h+Fnhb0paSpgKZmTDAyyLj5QpYGde:p+TUA0paSppZ+Ayyf5QpYGde
                                                                                                                                                                                    MD5:7862ABEC5008FAC0A8924B65B3058C05
                                                                                                                                                                                    SHA1:BC6A3F405835E3F3290CB521CA2A9AC85EAECDC4
                                                                                                                                                                                    SHA-256:44056C45DE472FF1A5037FC24CC2417218CF4FA500B6A7158BD8AA221268B69F
                                                                                                                                                                                    SHA-512:C91A1DCC08EAECF7F99B37684E02F3F89D18DBAF24B2BF3849CE78965A38E8A995ABBA03C0F8F20420AA15519439F0C662165BAA6A31BFE3CF994AA51F67C8F8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%O.e.B...h.F...i.`...j.l...k.{...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......#.....(.....0.....8.....@.....G.....N.....U.....V.....W.....\.....~.......................c...........Y...................................$.....Q.....'.....x.....~.....{...........4.................".....d.....0...........d.................l...........&.............................%.....(........................ ..... ..... ....."....3#.....#.....$.....%.....&.....'.....'.....(.....).....*....E*.....+.....+.....+....),.....,.....-.....-.....-.........../.....0....f0....N1....$2.....2.....2.....3....G4.....4.....4.....5....G6.....6.....6.....7....Z8.....8.....8....$:....M;.....<....N<.....=.....=.....>..../>.....>....t?.....?.....?.....@....^A.....A.....A....&C....!D.....D....7E....!F.....F....?G.....G.....H.....I....=J....~J.....K.....L....@M....sM.....N....#P.....Q....3Q.....R.....S....1T.....T.....U.....V.....W..../W.....X.....X....)Y....RY....sZ....g[.....[

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\mr.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ms.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):524044
                                                                                                                                                                                    Entropy (8bit):5.251286724342732
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:SgRSValNdUMLjehAr7nQjBx7+27fldjiMIUcGm95AIHxOMVLLEWVHs:SOSmu0jeAnEx7BldPc95n0Mu
                                                                                                                                                                                    MD5:5EE8AEFF66C42600D73F9CB7D8366CCE
                                                                                                                                                                                    SHA1:DAB706F52B7F6099286D659EFC24ADBAD9F5A4F2
                                                                                                                                                                                    SHA-256:A87B9926FBC7C17D884ABE1D8E4B81335476B00FFE76196E38AF8542E2D7881D
                                                                                                                                                                                    SHA-512:96145B505C3726878162EF4AE328F08888F1CBCF3C3D8AADFCE4E72398651D1B120C4D219176E107F99BD682D968D3C8F02AA8BF600007033AAC07064127A8EA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........S&..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}.....................................................................................5.....L...........S.................'.......................;.......................m.................0.............................}.........................................*.................^.....v.................C.....L.................".....-.................&.....7...........(.....{.......................9.....K.............................i.......................O.......................\.......................U.......................E.......................5.......................C.......................f.......................N.......................).....u.......................^.......................>.....V.....b...........#.....T.....c...........0.....q............ ..... ..... ..... ....S!.....!.....!....."....k"....."....."....."....G#.....#.....#.....#.....$....o$.....$

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ms.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\nb.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):508553
                                                                                                                                                                                    Entropy (8bit):5.428763068409714
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:h63MVtpURb8w5Op7fQ9S8GNxRV5/n4FJFEWt:h63MVXUa65GNxRV5f4jFP
                                                                                                                                                                                    MD5:40B668B73BBF3575D009F3D528D388E5
                                                                                                                                                                                    SHA1:E7186E4796216615F388C8A8058D898C4913F2FD
                                                                                                                                                                                    SHA-256:8813FA272B1A12042C75B97848605C8DA7D306AC7AAA4F231D41EE98D9E70538
                                                                                                                                                                                    SHA-512:8858E78493FBDBE1B2B99BCE75DAAC585F40EEA2612D80D82850F7957F0EF69C3A1F3DC7C011427CB1E64CD667031DEBD3B3D160BB9C2146224377A99B74798A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........*&#.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...............................................................................................}.................[.................3.................!......................./.............................v.......................w.................&.................H.....k...........x.................R...................................S.....m.............................L.............................m.......................P.....u.................L.......................X.......................^.......................S.....|.................J.....x.................p.................&.....~.......................b.......................G.....i.....{...........h.................9.......................? ..... ..... ..... ....T!.....!.....!.....!....b".....".....#.....#.....#....+$....u$.....$.....%....f%.....%.....%.....%....A&....^&....l&.....&....6'....e'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\nb.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\nl.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):525362
                                                                                                                                                                                    Entropy (8bit):5.366124885898627
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:TZpCbai+lbWusvbgQ5Pax5ttonxEGp7KY8OTy:3Cmi+lbWusB5Pax5tenxEGp7KYH2
                                                                                                                                                                                    MD5:6E38F51EBC9B4AF616C984ACFEF7323E
                                                                                                                                                                                    SHA1:1D871E09B051CDF1429FBB68FC43B7631DAD9438
                                                                                                                                                                                    SHA-256:E3ED1D14209965FACA5AC6A2B4026A4A28D21F5096E0C44943E731279190D540
                                                                                                                                                                                    SHA-512:4124F5ED6E9AC7701837AAE5458DB96DF8303FFF05ECBAB40D938CF0FDE3C5F2F696D07F0BE2227040A14336D2701F8A76342550419630F51C073070DC705492
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................U.................4.................@.....T...........;.......................c.......................[.......................?.....g.....u...........M.......................}.................4.......................=......................._.................(.................g.......................C.....W.......................$.....y.......................h.......................j.......................O.......................,.............................v.................,.......................N.......................?.......................".....x.................&.......................B.......................$.......................C.......................z ..... ....P!....a!.....!....O"....."....."....##.....#.....#.....#.....$....j$.....$.....$.....%....`%.....%

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\nl.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pl.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):587942
                                                                                                                                                                                    Entropy (8bit):5.759897632158159
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:l2o5czDWoOB/kbwvGfQfR6HAEbFVP+CUdCe3mUUFMAmW1Qh4Mh5vJ14scsy:woGYabMe1Qhz5cR
                                                                                                                                                                                    MD5:2D6468A89698A05B8522F679825572D3
                                                                                                                                                                                    SHA1:52EC81BC896051ED8A865B44C58F82EABA6B89B9
                                                                                                                                                                                    SHA-256:477E505459C80A8477FA6EF1B8A0FAF16C5E450B69CF922C37BBE020A088E695
                                                                                                                                                                                    SHA-512:59A95F05D071C739D4DC1456B856D0283AD3D99AC35EC300EC38E76AB236BA6D6E83598D0823D46C07D62EE0457F2958C682F4EFA3EADB824A254F48387EC538
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......../&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.#...v.8...w.E...y.K...z.Z...|.`...}.r.....z...............................................................................................(.......................{.................Z...........$.....B.................F.....\.................=.....Q.................P.....b...........9.....o...................................h.......................~.................&...........#.....n...................................w.......................7.............................I.....j.....x...........A.....z.................I.....|.................C.....t................./.....[.....k...........'.....[.....l...........V.......................U.....r.................2.....S.....y...........(.....i.....~...........P.................#.....i.................. ....Q ....w ..... .....!....p!.....!.....!....R".....".....#....,#.....#...."$....e$.....$.....$....J%....w%.....%.....%.....&....7&....F&.....&.....'....\'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pl.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):551569
                                                                                                                                                                                    Entropy (8bit):5.417670979179483
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:fl4UKe4ouC2NBXBL1WkoyVH5gcJBM90sRaY5K/:WzeRf+5TJ/sR15G
                                                                                                                                                                                    MD5:FBD585195E35E49C60A9190FBF815E86
                                                                                                                                                                                    SHA1:F88FE564784D0441A304A4B126DE27FB2B0412EE
                                                                                                                                                                                    SHA-256:ED647E78BC3E89A6322A7198DD1875034AC3CDA355BA6837EA0D4686D56712CD
                                                                                                                                                                                    SHA-512:22596E824D2226C8E0773F323FDDCB1A0C7523EE2077C38205EDB5B11EF15DE3C5768B8C598A781BDC49BE91C3B1B22BA92C3DA5E0BE6ACB5DF42670487E68E0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s."...t.+...v.@...w.M...y.S...z.b...|.h...}.z.....................................................................................................).......................m.................I...........5.....R.................Q.....f.................6.....F.................%.....>...........2.....x...................................x...........$.....5.................:.....N...........<.................4.................$.....s.......................S.......................Q.......................T.......................W.......................9.............................g.......................\.................).......................^.......................-.....y.................P.....{...........$.................$.....p.................. ....T ....{ ..... .....!....^!.....!.....!....H".....".....#....2#.....#....3$....}$.....$.....%....Z%.....%.....%.....%....2&....X&....m&.....&....E'.....'.....'.....(

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pt-BR.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):555353
                                                                                                                                                                                    Entropy (8bit):5.392038775374042
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:B2lInvsb1Nq9rX7YZieJVJJxhQ3shYfVh85IKlbSRDF:EAvsb3qdXj85IK1SRB
                                                                                                                                                                                    MD5:C64146716C2A401FEC538E4C79785144
                                                                                                                                                                                    SHA1:3C5D0B45225A39A65C0345E5C98A4E539D807FE1
                                                                                                                                                                                    SHA-256:904189CAAEF1E278EE31432F8995BFC150975250FA355683E1CEF1B5C79D3BF3
                                                                                                                                                                                    SHA-512:CE8336F4C83E47779169B3F875D8910F7C30CF7BCA2CF77C398C37E32FDC8C01A43B5EF74CFD03C3ABE8E3979454EBB1396CEA7449640025423D2B1F565A5C0C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........I&..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}.....................................................................................".....4...........H.................&.......................u...........U.....p...........[.......................f.......................G.....t.................t.................Z.................2.................K.....X.................W.....g...........9.........................................e.......................P.......................H.......................X.......................`.......................K.......................$.....z.......................h.........................................H....................... .....`.....z.................O.....|.................o.................>........................ ....o ..... ..... ....*!....{!.....!.....!....i"....."....D#....\#.....#....L$.....$.....$....1%.....%.....%.....%....@&.....&.....&.....&....3'.....'.....'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\pt-PT.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ro.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):574388
                                                                                                                                                                                    Entropy (8bit):5.451836104471441
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:NTIexSy0/AfWKXEjvyJe/FoMxOINkjK0yGZq5BZyo2cs2V/qE53:NTIeTOKXEuJUFoyO/u0zq5BAor/d3
                                                                                                                                                                                    MD5:C613CAB2C2D6AC5B88E21FCB65671F19
                                                                                                                                                                                    SHA1:291D545427FEAF8DA9DD75679ADA1BB70C66EB47
                                                                                                                                                                                    SHA-256:8EDD01CC74EB965CFA4CB35249097D114F554B8D80883D7C7E335A857F33A810
                                                                                                                                                                                    SHA-512:1E826936C1636F7D5DA9870DD362984E2DEDB8F3BFFE3F64D8615BC955F4A1C2E988E7FB60387743949C200DF073FBB7B27DC3B6A66BA9D7950571CA2DD2FE57
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.!...v.6...w.C...y.I...z.X...|.^...}.p.....x.....}...................................................................................{...........Y.....s...........4.....m...................................y...........$.....C.......................%.....|...................................".....S...........A.........................................P.......................g.................#...........3.......................U.....s.................&.....K....._.................$.....4.......................4.......................+.............................Y.......................8.......................S.................5.............................W.......................V.......................q.................\.......................$............ ....; ....V ..... .....!....Z!....o!.....!....l"....."....."....a#.....#.....$....7$.....$.....%....F%....^%.....%.....%.... &....6&.....&.....'....s'

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ro.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ru.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):941599
                                                                                                                                                                                    Entropy (8bit):4.851052751447414
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:tqeL4fQjRo4Y+5NMx/K69zJ9ZFdAal2a4qSGsN9z/0TYH8eXN2hVO3j/tSbzvMBS:tKgk5b6tS
                                                                                                                                                                                    MD5:36D9CBBB31930EB5B78378EC63751BE6
                                                                                                                                                                                    SHA1:5D123C38941CC4E59570254909291B29970F0CE1
                                                                                                                                                                                    SHA-256:DE90BA6507DC032C853FC61BDBF9218A29FF70379B571B1F4F3D7A28C3902479
                                                                                                                                                                                    SHA-512:EACCC7FBDF3E9D9C9EB1A602C1BF17C8BAFC920EBD058C4D2C496B95BB1B3FABCDFC87D1747BFD8CD404DE75C887038A99717BE7960BC808B632039EC9F80A06
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%..e.H...h.L...i.]...j.i...k.x...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}....... .....%.....-.....5.....=.....D.....K.....R.....S.....T.....V.....s.............................P.......................2.......................c.......................!.....f...........O...........W.....z...........,.....p...........;...........-.....i.....\.............................,.....~...........Z...........;.....`.................B.....o.....s.....m...........<...........O.....|...........=.......................~.................9...........>.....w...........B............ ....A ..... ....D!.....!.....!....."....."....."....."....a#.....#.....$.... $....2%.....%....~&.....&....3'.....'.....'.....'....s(.....(.....(.....).....)....+*.....*.....*.....+....M,.....,.....-.....-.....-....%.....7...........f/...../...../.....0.....1.....1.....1.....2....A3.....3.....3.....4.....5....:6.....6....87.....7.....7.....8.....8.....9....E9....^9....6:.....:....S;

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ru.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sk.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):592404
                                                                                                                                                                                    Entropy (8bit):5.807054231111397
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:phWgwEC/qsIkBr7iIip+RC5y+dbLxrQzLPxt9eH:zWR/qsx7iCC5NLaBtEH
                                                                                                                                                                                    MD5:59822645439846B0A211C8566E7CF90E
                                                                                                                                                                                    SHA1:F4EDAE1B34DF718FD72EBEBD6DC9E36CFEF95584
                                                                                                                                                                                    SHA-256:60319C30E94770472017E83ED0309A8F134F0D60E38261F53517EA23E9658C09
                                                                                                                                                                                    SHA-512:E2A7295BBFD5E721C765F90FAE0AD1420902A916E837E1B0BD564BB9EB553908EADEA58739F21D75C9F38CD3D1E821DCF14545884462FAA3F70617AFC764B84A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........2&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.%...t.....v.C...w.P...y.V...z.e...|.k...}.}.....................................................................................................S.................W.............................&.....u.................`......................................... .....z.................6...................................Q.....t...........k.................1.......................u.........../.....F...........k.................9.....................................................|.........................................S.......................h.......................y...........'.....:.................F.....Y...........s.................(.....v.......................Z.....v.................U.................- ..... ..... .....!....o!.....!.....!.....!....s".....".....".....#.....#.....#....@$....Z$.....$.....%.....%.....&.....&.....&....8'....Y'.....'....*(....Y(....m(.....(.....)....>)....R).....)....I*.....*

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sk.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sl.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):568760
                                                                                                                                                                                    Entropy (8bit):5.4785168337779435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:1Hr7a+NC5qB2r+JpEE5U8c2JHvbxi/fz8lqc:1L+UC5fyEE5U8cAi/fz87
                                                                                                                                                                                    MD5:970F310ACBAFA4A29E0CFA5C979DF397
                                                                                                                                                                                    SHA1:B1C20EEFC61785C3CBAF7D6D3B5FD2B144CC1EF5
                                                                                                                                                                                    SHA-256:B4EFD0CE0957A00E2E617A3E595B471ADFDFBDEE333C14BA41B8DC8BB5653324
                                                                                                                                                                                    SHA-512:D1DF03814C42819F94A7CF3FA54D699AC8A844C69303CEAED97BA3D3512406161F011120395904B473EACA29D8959B9A14C85D90A880508611E80A46B9D97575
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&3.e.z...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................[...........=.....V...........,.....].....n...........z.................N.......................S.......................E.......................W...................................B.....c...........A.....{.................e.................1...................................l.................A.....X.....p...........".....E.....U.................:.....M...........0.....l.................G.....z.................q.................&.......................'.......................6.......................Z.......................B.......................9.......................`.................3.................. ..... ..... ..... .... !....4!.....!....."....D"....\".....#.....#.....$....1$.....$....f%.....%.....%....e&.....&.....&.....'....a'.....'.....'.....'....S(.....(.....(

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sl.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sr.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):872667
                                                                                                                                                                                    Entropy (8bit):4.788135484665425
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:i5s/IU2p79qWYZAYI8dlSDdrPuzQhrUPb7FW5fZPT0xT7xH47L37SjeUM/k/3:IsZhYIlW5exxB
                                                                                                                                                                                    MD5:5E439D9D281D90569CD4AA231FC8B287
                                                                                                                                                                                    SHA1:AA8D4E28770F430DD7F93E2B9879748A97C74FB0
                                                                                                                                                                                    SHA-256:9082215832960416F3E6B43D2F76869A8632506BFE3A806A1B46C858B1370806
                                                                                                                                                                                    SHA-512:C9491A35C082B1BB7C08B732D6F07DBFFA5BB955988141D3C56D3F482D9FA74763EB196AA7F37445808163AB790A0B23091C06F81EBACB94BD164DC72B01A71C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........<&..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.....................................................................................>.....s.....`.............................:.............................#.....W.................H.....}.....$.............................!.....h...........Q...........@.....{.....{.....9.......................a.......................A.......................e.................$.......................j.................3...........8.....r...........! ..... ..... ..... .....!....J"....."....."....}#.....$....R$....s$.....%.....%.....%.....%.....&.....'....Q'....r'.....(.....(.....(.....).....).....*.....+....3+.....+....9,....q,.....,....8-.....-.....-................Z/...../...../.....0....#1.....1.....1....z2.....2.....3....L3.....4.....4.....4.....5.....5....{6.....6....-7.....8.....8.....9.....9.....:....5;.....;.....;.....<....4=.....=.....=....2>.....>.....>.....>.....?....q@.....@

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sr.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sv.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):512705
                                                                                                                                                                                    Entropy (8bit):5.538975019723545
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:UoQDiRIZXEr1COYNcNUAvSrZxkmvZl1HI4RFcz9RyoxGOGW3IiRMaSOmDE/xWcqX:DQDRZXllNcGrjr5O57ze
                                                                                                                                                                                    MD5:D31FED9E04F8915045F6A2CC7BD4C9FE
                                                                                                                                                                                    SHA1:8C68186DC5463D4E45889E8DE021536110B09453
                                                                                                                                                                                    SHA-256:931598B71AD77874A64294614BA73B426A717F343674FCEB7BAEE227D4413B9D
                                                                                                                                                                                    SHA-512:3C9D2F8F655006722AC5B08E8575EDAC9CCE21061B3A8696B8E772734A12BBFE04C53838DEC475887DBC82501E90A8799ACE71DC49BA05CF766037D001852493
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%V.e.4...h.8...i.I...j.U...k.d...l.o...n.w...o.|...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................!.....).....0.....7.....>.....?.....@.....B.....S.....e.....y...................................Y...................................b.....{...........K.......................V.......................U.......................z.................L.................$.........................................8.....H...........D.................@.................M.......................".....z.......................W.......................K.......................X.......................M.......................=.......................4.......................?.......................T.......................-.....}.......................N.....o.................Y.................$.....z.......................k.................. ....a ..... ..... ....,!.....!....."...."".....".....#....I#....o#.....#....;$....k$....~$.....$.....%....6%....D%.....%.....&....1&

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sv.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sw.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):539452
                                                                                                                                                                                    Entropy (8bit):5.338235032300934
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:pGnHmfiscrB5G7CCRdCAUQbQW4243xaKFNUq89F1ggt45JUAcwg6yJMkJPe/Bmqa:pSoo5GH
                                                                                                                                                                                    MD5:F0314E8F5AF94C845AB4218468AF3454
                                                                                                                                                                                    SHA1:4ABFA3D5D114AE89CB449F83C1267DA3DB0EF8BE
                                                                                                                                                                                    SHA-256:0CE0651A673A250FA86E6A9DF4EC490C832F045E07617343F015599687AA84E8
                                                                                                                                                                                    SHA-512:11E6CA00ACD7D65495F7C04BA5E558DAAD835C48BD230F616DE62954B9E10FC45E816E049E1ADB858B29D335DA08808B560F04C8A6AED83B62ED722F1968C08F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........)&$.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.(...w.5...y.;...z.J...|.P...}.b.....j.....o.....w.............................................................................u...........D.....Z...........).....h.....z...........m.................2.......................$.....w.......................\.......................f.................H.................,.................8.....H.......................<.................=.....Q...........`.................3.............................Q.....t.....}.................=.....I...........,.....w.................6.....j.....|...........@.....}.................0....._.....l...........&....._.....h...........L.......................^.......................h.................*.....z.................F.......................x.......................S.......................a ..... .....!....#!.....!....."....u".....".....#....k#.....#.....#....T$.....$.....%.....%.....%.....%.....&....,&.....&.....'....['

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\sw.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ta.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1387366
                                                                                                                                                                                    Entropy (8bit):4.061553280377292
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:cyu/keC6jicF5ZzVtR6cA25tm1vYpiMyg:Yj9F5ZzUcA25tm1vYpiMyg
                                                                                                                                                                                    MD5:4411E4698E279FB95ADEA7BE9625F800
                                                                                                                                                                                    SHA1:A3C655D334442CF5EF106B92F9778C9B3FBC252A
                                                                                                                                                                                    SHA-256:BEABEEA92C3FB9C52C22BADD99D686F1690E3574C75CD7A886320FB2CAC53D92
                                                                                                                                                                                    SHA-512:4406ADF5F7BEB86A49695FFF0A3E92E108AC2EE4DAAE46821C74164018FBD72E6D1DDA7C3B689B30A1F19C17B13B0C1BF0537C966ABE88137A0135D04483BF41
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........&7.e.r...h.v...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.*...|.0...}.B.....J.....O.....W....._.....g.....n.....u.....|.....}.....~.........................................{.....A.....j.............................n.......................5.....k...........9.....:.....-................................... .....X.....\...........G.......................#.....D.....Z ..... ....@!.....".....#....L$....}$.....%....&'.....'....U(.....).....+.....,....^,....a-....*.....~............/.....0.....0....-1.....2.....2....K3.....3.....4.....5....F6.....6.....7....z8.....8....-9.....:.....;....y;.....;.....<.....=.....>....<>....6?....'@.....@.....@..../B.....C....\D.....D.....E.....F.....F....4G.....H.....H....;I.....I....aJ....JK.....L....bL.....M.....N.....O.....O....yP....?Q.....Q.....Q.....S.....T.....T.....T....qV.....W....eX.....X.....Z.....\.....^....8^....._.....`....Va.....a....6c....\d.....e....me....qf....^g.....g.....h....Pi.....j.....k

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ta.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\te.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1281329
                                                                                                                                                                                    Entropy (8bit):4.31693967998977
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:lGfZBWX7McKNsC1ot59d4e/gb0HrWs05Bk3p1FZNViFlJ2wtg+NFqhrOlHXAAFwG:cxBWVZd57MkC
                                                                                                                                                                                    MD5:443D47F30632512C7E5A6E142D2A3CA3
                                                                                                                                                                                    SHA1:98730D4194266544C204E11E30C1817A5C8DFAE6
                                                                                                                                                                                    SHA-256:12267195833FF2F15F99947478C75EEB18923EB125AAF7118A0F398045636E33
                                                                                                                                                                                    SHA-512:34A02D50B300E8283A896BA492277FB6D2C16BFEEF88B30344C803D060DC50FA638BECA10F5113EBFE23D6E5882D82D072303112008FA721FF20EA087385C71C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........I&..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.........................................................................).....].........................................a.....S...........<.............................>.....W...........1.......................D.....S.....#.............................7.................D...........p.................0 ....q .....!....."....4#....w#.....$.....&.....'....I'.....(..../*.....+....i+....T,.....-....Y-.....-..........|/...../....(0....<1.....2....l2.....2.....3.....4....x5.....5.....7.....7....Z8.....8.....9.....:.....;....J;....i<....9=.....=.....=.....?.....?....d@.....@.....B.....B.....C.....C.....D.....E.....E....+F.....F.....G.....G.....G.....H....rI....3J....kJ.....K.....L....RM.....M.....N.....O.....O....LP.....Q....jR.....R....;S.....T....>U.....U....!V.....W.....Y.....Z.....Z....v\.....]....:^.....^.....`.....`.....a.....a.....b.....c.....d....Kd.....e.....f....Ng

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\te.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\th.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1076392
                                                                                                                                                                                    Entropy (8bit):4.3678914271676845
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:lk8N9LyZYAST4z1L/L1XPVLsbhRy1cW+v1H5UJEyL3ftj8wlz9eTRo98GkK9uLAR:lip5h5F
                                                                                                                                                                                    MD5:ABFAD720A09628E229EE75C14DCC1DEE
                                                                                                                                                                                    SHA1:80A075F9714D4C3BAFF06E1935B304558C3D597E
                                                                                                                                                                                    SHA-256:0C8332F2C81038A69282A049FD59EC76F2370F329F9AEFF9A54AE1B0AB83AFB1
                                                                                                                                                                                    SHA-512:D43A39699ED5F0E55A4491B726B44CF6238C9FB69C919F5DBFFBF6627221C524737115AC4FF604A1B6208AF7CAD52192CE896A6C57EEBE3A9BB721F9EC57ADBD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........Y%..e.....h.....i.....j.....k.....l.$...o.,...p.9...q.?...r.K...s.\...t.e...v.z...w.....y.....z.....|.....}...............................................................................).....S.............................................................................6.....u.................+.....|...................................(.....p.................g...........P.....G...........X...........w..... .......................4.......................B...............................................q............ ..... ....|!.....!....."....."....f#.....#.....#.....$....n%.....%.....&.....&.....'.....(....&(.....(.....).....*....:*.....*.....+.....+.....+.....,.....-.....-..........4/....10.....0.....1.....1....\2.....2.....2.....3.....4....a4.....4....65.....5.....6....M6....m7...."8.....8....(9.....9....=:....t:.....:....y;.....<....b<.....<.....=.....>.....>.....>.....?.....@....jA.....A.....B.....C.....D.....D.....E.....F.....G....FG.....G.....H.....H.....I.....J.....J....pK

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\th.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\tr.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):550618
                                                                                                                                                                                    Entropy (8bit):5.609493488679069
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:cHODNEWFOVqzdRdiZmqDhz0yqxv8CcHuki4wge75HX/2+1i1nEedGAMYw/KOe67:4OyqFCmG4zkiN5HX//
                                                                                                                                                                                    MD5:CE85F55613C69479E13D011F0B81E3F1
                                                                                                                                                                                    SHA1:07C31DF75DEECEC1BC09FFCD473B885EF0467B42
                                                                                                                                                                                    SHA-256:EEA13AECCB9DC35CF6E5135BCAB2F376D584CDEFC4B2970ED1126F8C2043AFCC
                                                                                                                                                                                    SHA-512:3A6C6015003A09295AB4CA7BBBC421F281E3A8719C56EF9D0BB4448413656778DA7C70D7F67FCBED7051E562027CBD7BCEA84596E48AADA64193AF448002120C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........Y&..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...............................................................................2.....G.....a.............................c...................................X.....s...........4.....o.................+.....R.....a.................D.....V...........&.....X.....z...........m.................2.......................1.......................>...................................A.....Y.................C....._.................M.....^.................H.....X...........#.....Z.....g...........6.....m.....~...........?.....q.....~...........:.....j.....v...........;.....o.....|.............................S.......................T.......................4.......................G.......................e.......................L ..... ..... ..... ....d!.....!.....!....."....."....b#.....#.....#....z$.....$....6%....Z%.....%....`&.....&.....&....)'.....'.....'.....'....@(.....(.....(

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\tr.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\uk.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):938457
                                                                                                                                                                                    Entropy (8bit):4.888192308730272
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:iqzRMYWYPnfzKj0meRi8ICN5ZB3IjMAlLEXdcuKLNiXEqqbQuKz+4uL2uoj:/uSz58E3
                                                                                                                                                                                    MD5:E72DBF8C00F7C211D1A220DB30EC7A7E
                                                                                                                                                                                    SHA1:8F891C83E0FBAA78A8267CF5B54462BD64DE9C6F
                                                                                                                                                                                    SHA-256:B1892427972D0454F8B85AF85DCC074393FFBCB2381EA91EFB2E85EB03FF2A04
                                                                                                                                                                                    SHA-512:D1F3E5DBC50B14FEADFC30999C89DB1A0431E4758EE82CF18DA81F991CDF76C3298FD98D3CB3E2AB902A11C8A7E11C6D7645E1ED91ED5F3280A4420C1FB793D0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%q.e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................,.....E.....o.................X.......................Q......................._.......................z...........)...........L.................j...........V.....k.....'.................L.....9...........{...........i...........c...........1...........%.....F.................$.....Q.....@.......................T.................#...........,.....l.........................................8 ..... ..... ....V!.....!....0"....K"....."....\#.....#.....#....N$.....$.....%....3%.....%....F&.....&.....&.....'....t(.....)....?).....)....Q*.....*.....*....*+.....+.....+.....+.....,..../-.....-.....-..........l/...../....[0.....0....\1.....1.....1....d2.....2....(3....U3....,4.....4....25....^5....P6....$7.....7.....7.....8.....9.....:....Y:.....;.....;.....;.....<.....<.....=....U=....r=....F>.....>....b?

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\uk.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ur.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):817673
                                                                                                                                                                                    Entropy (8bit):5.177156515939135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:C7a3H/NvV+8PomRMD2nyBO3QU5ANJhEFZWPOEojYzQYrNwadcJKwU8ueco/9Njjk:Vvvt5LWp
                                                                                                                                                                                    MD5:3129155651C81F86E5E2794B0CD15EC7
                                                                                                                                                                                    SHA1:FB3D6C2156E1230C099B02171F3E9100FBE542A8
                                                                                                                                                                                    SHA-256:67B353376ECC45F0271CB2526B96AEB681F717968C35397F7E53AA43D3D31D08
                                                                                                                                                                                    SHA-512:31831DEAD97B53E600317091DC08807D1D040A1FC27753CCEB4104A865583C79E1EC68FE6AB644819EF49F262981ADB6EF38D67CB53CB3FDDD43271780FEFCEB
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........-& .e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.-...w.:...y.@...z.O...|.U...}.g.....o.....t.....|.........................................................................................;.....b.......................R.....1...........m...........U...........\...............................................Z.....}...................................\.......................6.................W...........S.....p.....C...........}.................N.............................,.....T...........?.....|...............................................S.....q...... ..... ..... .....!.....!....."....Y"....u"....."....q#.....#.....#....\$.....$....*%....F%.....&.....&....3'....^'.....'....n(.....(.....(....d).....).....).... *.....*....'+....m+.....+....U,.....,....Q-.....-............................./....&0....x0.....0....p1.....1....j2.....2....k3.....4.....4.....4.....5....W6.....6.....7.....7....w8.....8.....9.....9.....:....]:.....:..../;.....;.....<

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\ur.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\vi.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):651358
                                                                                                                                                                                    Entropy (8bit):5.790776889845594
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:BhaQjDW+cuwJ/roEKaaFoGnXy0bxcPdH9+vUx5WY8hZq94KibJziMHo6wtk1e:B0d+cuwJ/7a3ni0be35N8vq1ibliMI6U
                                                                                                                                                                                    MD5:5910DEDFBC84629690DD59478E80B51A
                                                                                                                                                                                    SHA1:AF6E9281C779E40ACF1A8A1EABB1AA926AB85F85
                                                                                                                                                                                    SHA-256:0832B96542456367261A215719ACDCC394A027C04A4F0C313F9401D6B222F756
                                                                                                                                                                                    SHA-512:1BD32EFA3D034442D85D2478EFA8180E11126E80F03097B813CCFD4521039E186342CC9EFAA47809DB9852ADA3541B76E668D43C7A427D2410DAB6C0A1BA1B2C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%q.e.....h.....i.....j.(...k.7...l.B...n.J...o.O...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....|.....}.........................................................................&.....7.....`...........7...........U.....q...................................*.................?.................%.....z.......................o.................!...........@.................}..... .................I...........&.....8...........7.................?...........$.....L.......................,.................'.....F...........&.....P.....a...........A.....}...................................V.......................k......................................... .................C.....U.................. ....% ..... .....!....O!....n!.....!....C"....m"....."....d#.....#.....#....c$.....$...._%.....%....)&.....&.....&.....&....w'.....'....!(....D(.....(....>).....).....)....]*.....+....s+.....+....L,.....,....J-.....-..........m.................&/...../...../...../....s0.....1....[1....|1

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\vi.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):472125
                                                                                                                                                                                    Entropy (8bit):6.686635546459109
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:y3OYfu048lFDezkK7/56jOIydpD65imqjNnEwYHB074lK:y3hfu0HjyzX56jOIyz65rcNnEwmBK
                                                                                                                                                                                    MD5:79D8DDFE89B3B2B37BBBF85AFD6E6D67
                                                                                                                                                                                    SHA1:0D0316D3D1DA0D13D2C568F0FAB9116996998C7C
                                                                                                                                                                                    SHA-256:ABBF9199B7751AD09750361E2EE861876EE44D65020B7D1255C45DFF911BCF89
                                                                                                                                                                                    SHA-512:5F6B736B835DF71BA67906710BF86CDEB37542642CC03FFE6CC73557C2BE35CE99C5838739B160D26545D7A55E4263DEE7E55E942307F7D8657E3E8FAFDE5114
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....v.....w. ...|.&...}.8.....@.....H.....S.....[.....j.....o.....w.....~...............................................B.......................s.......................q.......................|.................2.............................X.......................7.......................7.......................S.......................D.......................*.......................1.......................4.....w.......................>.....d.....p.................#.....2.................:.....L.......................&.............................d.......................<.......................?.......................P.......................'.....u.......................h.......................K.............................H.....T.................6.....H.................?....._...........H.......................n.......................k.......................3 ....Q ....a ..... .....!....A!....S!.....!

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\zh-CN.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):469061
                                                                                                                                                                                    Entropy (8bit):6.698957808032297
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:6144:bSSfomw9A7NuQRFcjArmJflGj2DuUasg5b57jkzrMOZQyZV7zeHk2Tt:bSSf5wG7NuFjA0xasg5b57jkzbr/7m1
                                                                                                                                                                                    MD5:687995F645CB9169DBFC3431E8FCFE3B
                                                                                                                                                                                    SHA1:D6931394363D7C479791B32C8AD268786FFCE8AF
                                                                                                                                                                                    SHA-256:35A0323EB90FA53859961F832BCB66C391F53E6449722F6FDC136D92484C47C9
                                                                                                                                                                                    SHA-512:FAAAD1CE95650FA67AA7E86F2453DEDC70C6E206BB15DBA4E824BB0D540D884A09A75A48A9E36FEEB83B75232258B7431B1F3DF53A824FA322B3C4E87BEABA14
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........%..e.Z...h.^...i.o...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.......%.....*.....2.....:.....A.....H.....O.....Q.....V....._.....k.....z.................y.......................q.......................f.......................Z.......................A.....j.....v.................3.....@.......................0.......................1.............................r.......................a.......................w.................1.....}......................./.....{.......................F.....i.....x........... .....I.....U.................&.....2.......................!.....s.......................K.......................<.......................2.....x.......................>.....X.................<.....N.................,.....O.............................P.......................;.......................D.........................................0.............................[.............................h.................. ....Z

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\locales\zh-TW.pak.info

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1051021
                                                                                                                                                                                    Entropy (8bit):5.4211132061857965
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:SDb4GbP8IrxcFMOCGHo2QZIZ40P7usnnR6yTgkXb2X:dTgkXO
                                                                                                                                                                                    MD5:82D7AB0FF6C34DB264FD6778818F42B1
                                                                                                                                                                                    SHA1:EB508BD01721BA67F7DAAD55BA8E7ACDB0A096EB
                                                                                                                                                                                    SHA-256:E84331E84CD61D8BDACC574D5186FB259C00467513AA3F2090406330F68A45DB
                                                                                                                                                                                    SHA-512:176458B03CC2B2D3711965CD277531E002AE55D284B6C9178D2353E268F882430235468E5A1E9E45C8427864D109CF30A024A993B4763A75FA2744F6E0A6AE2A
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\node.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):18401792
                                                                                                                                                                                    Entropy (8bit):6.484724602010289
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:196608:UFhL+fUAW3m8p73KQ/ZxCSIK7Z5JG1xC/e:UFp+fUAW3m8pDKQ/ZxChK7Z5cjC
                                                                                                                                                                                    MD5:6A067CB26AF2C240C240BC81C4A4F311
                                                                                                                                                                                    SHA1:CFB1A89616DC14830EB073F4CD84AC4EB14B4534
                                                                                                                                                                                    SHA-256:C1E6EF50932D0CD9EDF8FF4C663CFCCA358F2E2D5349B3B7904E4D4D8F6D8882
                                                                                                                                                                                    SHA-512:25520B39C834BAAC056958C22EBA1B2317B0D7967F351C66BA6177FB9FFC3FD4B6C0E8489CFBD8B2E477854F75163856F23775BAE6B8A0721048FD961E276BAD
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Bx.e.........." ................L.........................................B...........`..............................................#...2..,.... A.......;..n...........0A.\t..|...........................(.......8............P...............................text............................... ..`.rdata....... ......................@..@.data...@9*..@......................@....pdata...n....;..p..................@..@.gxfg.........?......V..............@..@.retplne......@......F...................tls....a.....@......H..............@....voltbl.......A......J.................._RDATA........A......L..............@..@.rsrc........ A......N..............@..@.reloc..\t...0A..v...T..............@..B................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\notification_helper.exe

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1162240
                                                                                                                                                                                    Entropy (8bit):6.551791881008996
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:12288:ouraOSnSamNJMd26Fpz2vWISMtjK+N4cpfATBp5j2Iv8oia7gPhI+nkMoe8r8WJW:ouWJSap2spQ9tXATBT6IQa7S18oW4
                                                                                                                                                                                    MD5:EDF83410995BEA188731EF377334ED7B
                                                                                                                                                                                    SHA1:B12C8925409701725749A9EBCC9D6CBFDB0122DD
                                                                                                                                                                                    SHA-256:B464548564A8B97682560630127AA447D25FE692F887A4822A36B2EF8F250E97
                                                                                                                                                                                    SHA-512:A14B61223B0D2E1A7389934559EEC5279A1C2B0C713B0FDAA08F4F979A3B37D8BADED355B42AEF5FEA13A254AF177F5EB152C6C009985F3294C5097035907EE2
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........."............................@..........................................`.............................................\...t........p.......P..................................................(...0...8...........0................................text...F........................... ..`.rdata..............................@..@.data...........@..................@....pdata.......P......................@..@.gxfg....,...........`..............@..@.retplne.................................tls......... ......................@....voltbl.F....0..........................CPADinfo8....@......................@..._RDATA.......P......................@..@malloc_h0....`...................... ..`.rsrc........p......................@..@.reloc..............................@..B................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\nw.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):196713984
                                                                                                                                                                                    Entropy (8bit):6.709853681888895
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:1572864:T671igPCQDu9VieLAbOP1nmnq/lbL7IKJciUtkMHs5sx1qqV88:eJiDS610scieJq1
                                                                                                                                                                                    MD5:0B9A2D445F28B403D525380817A2636E
                                                                                                                                                                                    SHA1:E4BECC1533A42871BA87A06D039D3477ABE4F79A
                                                                                                                                                                                    SHA-256:264773127DEA00204A3A52BAE4A4510D610292FDD759B7EAF40BD1B59AD88C6B
                                                                                                                                                                                    SHA-512:45BF3DC8C1B118AE26B6A4436591D1B15B339BC6BD8E69E112F0F6ADDB834B0CFD8958AC63BFC712C4A7D9C365FC6944AB80F0D61765170ADF67B5535DEE12E1
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .........`...... S....................................................`A........................................G.-..!..../.|.......p.....R..B^..............T...i .8................... b .(...@..8............./......U-.`....................text..."........................... ..`.rdata..X.... ......................@..@.data... .... 4.......4.............@....pdata...B^...R..D^...>.............@..@.gxfg...0C.......D...@..............@..@.retplne.....`...........................rodata......p...................... ..`.tls....A...........................@....voltbl.v...............................CPADinfo8...........................@...LZMADEC............................. ..`_RDATA.............................@..@malloc_h0.......................... ..`.rsrc...p...........................@..@.reloc...T.......V...H..............@..B................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\nw_100_percent.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):685745
                                                                                                                                                                                    Entropy (8bit):7.962986984739525
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:9B46F4C8DFC0A55BFAFAC55F17D7659B
                                                                                                                                                                                    SHA1:D25F27DF176AADB67BC56A42262BCCAFD14AF4F4
                                                                                                                                                                                    SHA-256:B637AE345B830649B4027F39F6EE48F92484A2ACB65DE498E4FDD84EC1010336
                                                                                                                                                                                    SHA-512:DE5F500AFE381A16E3FF7DDCB5C8AA538362E55222F7915276BB4C9261E41CBC2403CA1663A7DBF0706D8D51ABC420E26804F67CFD646D7986130A20A659F345
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..........O............... ...........@.........p?....q?h...r?...s?<...t?....u?....v?h...w?...x?&...y?....z?...{?9...|?....}?...~?N....?.....?.....?J....?.....?}....?.....?....?1....?O....?.....?.....?.....?.....?%....?.....?.....?.....?.....?.....?m....?5....?.....?.....?.....?0....?.....?.....?e....?.....?u....?.&...?>'...?.'...?.(...?G)...?.)...?.2...?.<...?.P...?.c...?Ce...?yf...?.h...?jk...?.n...?.w...?.....?D....?.....?.....?+....?z....?&....?.....?.....?(....?.....?.....?.....?.....?6....?4....?.....?.....?.....?@....?.....?.....?.!...?]*...?.2...?38...?.@...?.A...?._...?/y...?.....?`....?9....?.....?U....?.....?.$...?S7...?E`...?.t...?p....?.....?K....?&....?.....?.....?.....?A....?.....?.!...?.+...?.3...?u;...?.C...?.H...?rT...?.^...?.b...?[g...?yl...?.}...?.....?.....?k....?n....?"....@.....@.....@.....@f....@.*...@M@...@.Q...@.c...@kq...@W{...@Q....@X....@c....@.....@j....@O....@R....@S....@....&@g...'@Z...(@....)@....*@....+@....,@....-@V....@..../@D...0@.8..1@.9..2@.<

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\nw_200_percent.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1079219
                                                                                                                                                                                    Entropy (8bit):7.95049008504143
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:F666B710DA2BED9AC0252C1FA1D00C4A
                                                                                                                                                                                    SHA1:0D8288FDE82C2F3B7BD006FCF4CB92246AEFAF6D
                                                                                                                                                                                    SHA-256:F1AB589CFD40FB17A7C390B45FFAD8FCF90C133FFF1D14CA5BFC7053A21DC241
                                                                                                                                                                                    SHA-512:982BB5EA2C14170D47E150DC8692EBE316EC5D6B584377020C1F58AE0632748CB631182A6BFAD2F909EF6B818B012527367A36D8681B5B56DC735B8CCAF7B52F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:..........O.........+...........|.....#.........p?....q?@...r?....s?,...t?....u?....v?|...w?...x?R...y?...z?'...{?....|?....}?V...~?....?.....?.....?....?I....?.....?A....?.....?.....?.....?~....?d....?.%...?.C...?.Y...?vn...?Qp...?.p...?Br...?.y...?Rz...?.|...?.~...?U....?.....?X....?....?.....?.....?.....?.....?.....?X....?.....?.....?.....?g....?.....?*....?.....?.8...?.:...?z<...?.>...?.D...?OJ...?._...?.p...?o....?%....?.....?[....?....?.....?.....?.....?.....?.....?.+...?.>...?.M...?Ra...?4u...?.....?]....?.....?.....?.....?.....?. ...?^4...?.L...?.[...?.t...?.w...?.....?u....?.....?.....?.....?.....?.+...? >...?7Z...?.l...?.....?t....?:....?.....?-....?.....?.....?.....?.(...?_7...?.L...?.X...?.b...?]i...?.q...?.z...?i....?.....?;....?.....?.....?....?z....?.....?H'...?.S...?.t...?d....@.....@S....@\....@.....@.H...@.v...@M....@.....@.....@a....@.....@.....@oI...@6....@.....@,....@....@.....@:...&@....'@....(@0...)@....*@*...+@....,@....-@h(...@94../@v>..0@....1@....2@..

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\nw_elf.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1134592
                                                                                                                                                                                    Entropy (8bit):6.555043286804751
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:364F839CA8DE4D942270D9097D48EF15
                                                                                                                                                                                    SHA1:82C8040DC2A733EB3EA3E051513C84F992BB17F1
                                                                                                                                                                                    SHA-256:A4E521C12FE47816F2D9E2DFED9FD074E370EC587D0A0F3A03B5AEBB76C06560
                                                                                                                                                                                    SHA-512:BAF1ED5E558DC0AE037FE0DFF036792CFBD338915C8AF99D10F0202B92CA820298657A86A0F3E8C1387326FDA34DE3EE08649C34AF2417159A24AED9CED02DF3
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .....V...........).......................................@............`A....................................................<.......8.................... ..<....~..8....................}..(...@...8............................................text...-T.......V.................. ..`.rdata.......p.......Z..............@..@.data...T....@...B...*..............@....pdata...............l..............@..@.crthunk.....p......................@..@.gxfg... ,..........................@..@.retplne.............$...................tls.................&..............@....voltbl.B............(..................CPADinfo8............*..............@..._RDATA...............,..............@..@malloc_h0........................... ..`.rsrc...8............0..............@..@.reloc..<.... .......8..............@..B........................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\resources.pak

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4656369
                                                                                                                                                                                    Entropy (8bit):7.995866504972196
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:0F1D45867B591D67B0301EE8C4AD5F7B
                                                                                                                                                                                    SHA1:F5FB6378C13912DF079EFEE44476FC1B4666EF24
                                                                                                                                                                                    SHA-256:A2434429FEA5B3344426E388F9A2191E10449103E933EF7F0CDBF4638F22380D
                                                                                                                                                                                    SHA-512:1DB79C82E67547A76D3D479168EE12899E7E03D8C065239976E0A490804182290B76829E483E8F18F7FEAFE7E819D2784C507D7ABCDAB917B62D78696059EE80
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:............{.,0..|.,0.....3.....5....~...........8...........Ol..........p.................K........... .....I......!....."....d$.....%.....&.....'.....+....MW.....X....I_....Pj.....p.....u.....}....G................?....?.....?.....?R ...?J"..-?.%...?.4../?.D..0?.T..1?.c..2?Gs..3?...4?5...5?k...6?T...7?....8?....9?....:?V...;?....<?.*..=?:B..>?.^..??Su..@?....A?Y...B?)...C?....D?....E?....F?....G?a)..t@],..u@./..v@.2..w@!8..x@.;..y@.@...APT...A.V...A.]...A.l...A3m...A.m...A`n...A.n...A7o...A.o...AGt...A.|...A/....A6....AS....Ai....AF....Al....AG....A;....A.....A.....Ac....A;....AE....AY....A....A....A....A.....A.....AP....B.....B^....By....B.....B.....B.....B4....B....,B....-B.....B`....D.....D.....DM....D_....D3....D4....D.....D.!...D."..>I.%..?I.&..@I.+..AI....BIj/..CI.0..DI.4..EI67..RI.8..SI.:..TI.<..yI"H..zIiR..{I/^..|I&j..}I.t..~I.....I....I.....I.....I....I/....I'....I&....I4....I.....IN....I*....I.....I.....IS....I.....I.....I.....I.....I4....I.....I6....I.....IV"...I.0

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\v8_context_snapshot.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):686733
                                                                                                                                                                                    Entropy (8bit):5.111423885670035
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:E68978443DDAFD40434C87818C90D338
                                                                                                                                                                                    SHA1:C38FC19A469E6C9AF4699ABFE00C5FFE39501726
                                                                                                                                                                                    SHA-256:7AC9FB58F00E735E266730FEFC25D1B3C4B58EC789D5540F0424E746712CD9DC
                                                                                                                                                                                    SHA-512:D9A7998A70E63ED8375052329033E83EEBDB6F856FFDE3C1077A450F985E379D04778EB30AD29CDAAABD33F4ED4437F8C18C73153B58375A8CD8AB26D8A64D54
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.............@..12.2.281.16.........................................................-............%..............a........a........a........ar.......a........a............v...Bw....w...Bx....x...By....y...Bz....z...B{....{...B|....|..(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....L...IDa........Db............D`.....).D`.....D].%.D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L..............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\vk_swiftshader.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4483072
                                                                                                                                                                                    Entropy (8bit):6.30617269058202
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:DB64B157590C89B63D7E7FCF97FD7A01
                                                                                                                                                                                    SHA1:64C320EA6A444561E6DEA1E6713DBACDA24B634C
                                                                                                                                                                                    SHA-256:53E35896FEF631BA844818E4D91013DA2C1E2324EDD0AFF93EC4F2747793B8A7
                                                                                                                                                                                    SHA-512:5429E4CAEEF300EF388E86595E5853C0C5B62EF8D3E0BF84469A994C8A5CD65D8EFF3A038BEF8992AE065A3A61EB765CA19810B6AEAD52F564BCC8D21EB717EF
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." ......3..........$0.......................................F...........`A..........................................?.....`.?.P....pE......PC.(.............E.....X?.8....................W?.(....O>.8.............?.P............................text.....3.......3................. ..`.rdata..D.....3.......3.............@..@.data.........@......n@.............@....pdata..(....PC.......B.............@..@.gxfg....,....E.......C.............@..@.retplne.....0E.......C..................tls....V....@E.......C.............@....voltbl.8....PE.......C................._RDATA.......`E.......C.............@..@.rsrc........pE.......C.............@..@.reloc.......E.......C.............@..B................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\vk_swiftshader_icd.json

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):106
                                                                                                                                                                                    Entropy (8bit):4.724752649036734
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                    SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                    SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                    SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                    C:\Users\user\PCAppStore\nwjs\vulkan-1.dll

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):918016
                                                                                                                                                                                    Entropy (8bit):6.582669085817742
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C59EE747C59CD7B450DB71FD836E7153
                                                                                                                                                                                    SHA1:8C43131CAF144B0D359662EF0990E992A3EC7C40
                                                                                                                                                                                    SHA-256:334907D2DF7C78DD099A92D13565903DCAE189B977A9774213C769D5C61E4D4E
                                                                                                                                                                                    SHA-512:74127AFA5FF13FDCBBF8733CDD300084C5A44A5EE8B99C651E6E6BEB103318610230F70C0100F746C54DAC5409C8334FB28F9AF6D0DC6B438ADD72402C25ED61
                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                    Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...P0Wd.........." .................0....................................................`A............................................<!..L...P................r..............8....p..8....................o..(...`...8............................................text............................... ..`.rdata..,....0......................@..@.data...|L...@..."...$..............@....pdata...r.......r...F..............@..@.gxfg...P).......*..................@..@.retplne.....@...........................tls.........P......................@....voltbl.8....`.........................._RDATA.......p......................@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................

                                                                                                                                                                                    C:\Users\user\PCAppStore\pcappstore.ico

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16958
                                                                                                                                                                                    Entropy (8bit):1.8361199320851
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:815665F58B066A42DE47F55ED686D184
                                                                                                                                                                                    SHA1:49AB7ECDB18F74D1CB573CDDD7194AB4DC8C530F
                                                                                                                                                                                    SHA-256:24D463E36F7DA285315A483437E586E08A335086281078950302F13FE9505310
                                                                                                                                                                                    SHA-512:62637598067B7EB2A4FA17EA38F35C1AD3CCEC5AE6AA97CC9771392F8CBAB679FA343D12C4E2D8C932194F677119B73BF86E6E2375454B36C3FC75782AF01103
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:......@@.... .(B......(...@......... ......@..............................................,h. ,h.p,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.p,h. ................................................,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h......................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............................,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\asset-manifest.json

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1303
                                                                                                                                                                                    Entropy (8bit):4.927996306534048
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:4B55D62B16ADCF19F8E466F9988DBEC7
                                                                                                                                                                                    SHA1:9563339C8D80DAEB5C7B38A21E2EE4A88EEC6760
                                                                                                                                                                                    SHA-256:19D56A07CD45027047FEDF6E80911711AA85035F3BED3819471709F40CF2A9D4
                                                                                                                                                                                    SHA-512:BC3D3250EF596664675CA264E85B88B2D8F89355A272DD539B485D01260C7BF038C16D92AF99EA8CA7B352A82C18D9CB749E8394F2272637999E2494AF76F457
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{. "files": {. "main.css": "/static/css/main.c1bf4e0a.chunk.css",. "main.js": "/static/js/main.717b6389.chunk.js",. "main.js.map": "/static/js/main.717b6389.chunk.js.map",. "runtime-main.js": "/static/js/runtime-main.cdd4f9cc.js",. "runtime-main.js.map": "/static/js/runtime-main.cdd4f9cc.js.map",. "static/js/2.801b9d83.chunk.js": "/static/js/2.801b9d83.chunk.js",. "static/js/2.801b9d83.chunk.js.map": "/static/js/2.801b9d83.chunk.js.map",. "static/js/3.cf9f4ce6.chunk.js": "/static/js/3.cf9f4ce6.chunk.js",. "static/js/3.cf9f4ce6.chunk.js.map": "/static/js/3.cf9f4ce6.chunk.js.map",. "index.html": "/index.html",. "static/css/main.c1bf4e0a.chunk.css.map": "/static/css/main.c1bf4e0a.chunk.css.map",. "static/js/2.801b9d83.chunk.js.LICENSE.txt": "/static/js/2.801b9d83.chunk.js.LICENSE.txt",. "static/media/SettingsWelcome.scss": "/static/media/copy_icon.570b8027.svg",. "static/media/index.scss": "/static/media/icon_weather_white.c0043930.svg",. "sta

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\favicon-16x16.png

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):278
                                                                                                                                                                                    Entropy (8bit):6.614793808897997
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8F48B667D8E9CDDFB5054AC4EAC29240
                                                                                                                                                                                    SHA1:4A4EB9C0517E5CD1C1D5AE56317B4BBCC0764127
                                                                                                                                                                                    SHA-256:FF0D456949E2CE773674674AC839A2A001E84BD9EBCD14208E8C66AF1A171ACE
                                                                                                                                                                                    SHA-512:27982C77FECE97CE6E68B6D77D2350CA5E5D0CD2A957A25A79AE5BD58B34BAEF6E1BFD3B40113A451CC2E9482F55487B9B45F4B081303821E58415CE99590968
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR................a....pHYs...........~.....IDAT8.c._.n..........H.........g.< Y3.0.>`B..................P..I10.d.6@F......T..=...f...$&..Q..-. t.$T... 1d5P..?C.?.?-p......k.....N......&...3..{.30\.....$.&J43...5...!...I@<......Y.0.....#.7. YcL....IEND.B`.

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\favicon-32x32.png

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):506
                                                                                                                                                                                    Entropy (8bit):7.41701077919571
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:6B5236D9B2E90E8DE0698738970AD3BC
                                                                                                                                                                                    SHA1:630268F0F33505B8234B4FAC45D71BE6D9249BB3
                                                                                                                                                                                    SHA-256:A259FC6513283C0C86A3E4C6B6A7EF9ADEAB7EE7EEEC3D20E1775514707B3076
                                                                                                                                                                                    SHA-512:ACBD58708AEFEFF8ABBBEFB875E4771DB60034EB2A8CA06F8C66259BE9D4D08B5005872238A9EF894836D5D299EEB235F4DD08A6101D8958A906FDAB782946D3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR... ... .....szz.....pHYs...........~.....IDATX..W.O.@.}4..]pCV?.....e....L.M...D......#.7u1.Q..A.M...q.E.c.4..+.....}...]/..a..!.]....GoQ..hz..f.lt.@...Nd...9........>(.......{.@p..|.K.TN.+...]....b...9..%..B.8@p.n.wQ..q).8...Lw. .^K:...U...r....<.4......\..T..K......y..Z...<. ....,.v..\h.r..[c.}W....+ce.X....>.....[9..pu.*?.........i~...Z8?....;W..K...&..y....=K...h.2.0.......,ml...8A..&np....?........(...P..7#...9/..s.hz...>-.=.'.?..p1P.......IEND.B`.

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\favicon.ico

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4286
                                                                                                                                                                                    Entropy (8bit):1.9733781811385676
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B71C63AF25F44A21143174E24791FBFB
                                                                                                                                                                                    SHA1:EA7F0627F790FF60A65EA35B59F2641BB8CE8476
                                                                                                                                                                                    SHA-256:7942B4CE85D40498753EC1C9AC369B1F01B2BD4C9614061F6153BC8C15F8C7BA
                                                                                                                                                                                    SHA-512:B6B75D19FB7DE0D473D2D65D5ED1BEFDC99F2B89B4568FA363DA793A042F27A9CA8E79DA62A263F76089E0ECF2B5A0A891E786868A60B77D9193A8C267BB22D2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:...... .... .........(... ...@..... .................................,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@............,h.`,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.`....,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h.@,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h..,h

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\index.html

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (3269), with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3269
                                                                                                                                                                                    Entropy (8bit):5.267907599850738
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B7C9F30D797A5B794AA4EDA8CAE5F69A
                                                                                                                                                                                    SHA1:42F270CF26D97C2DBC2E0A7979CF57FEF333B1A4
                                                                                                                                                                                    SHA-256:B8B97D7D84A7ED35B5FD7411C572D4B38FF40969E94676010BBB456E76518F60
                                                                                                                                                                                    SHA-512:D02AE1312B21BAAFD715E8E33FEB3336250F81E27636A914C14FB03F9249317444D53509A5FB26B814F23DC2D684CD27CA490CE06FCDF58322E23FB34854C01C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><link rel="apple-touch-icon" href="/logo192.png"/><link rel="manifest" href="/manifest.json"/><link rel="preconnect" href="https://fonts.googleapis.com"/><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin/><link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&display=swap" rel="stylesheet"/><title>PC App Store</title><link href="/static/css/main.c1bf4e0a.chunk.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div><div id="portal-root"></div><script src="https://pcapp.store/src/main_code_nw.js"></script><script>!function(e){function r(r){for(var n,a,i=r[0],c=r[1],l=r[2],f=0,s=[];f<i.length;f++)a=i[f],Object.prototype.hasOwnProperty.call(o,a)&&o[a]&&s.push(o[a][0]),o[a]=0;for(n in c)Obje

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\manifest.json

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):499
                                                                                                                                                                                    Entropy (8bit):4.571997514321595
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B6D88DB0D0FF77D182C5BFA47A6649D4
                                                                                                                                                                                    SHA1:4502E844EE48233B345B3AD057FCD1101EC8F3F4
                                                                                                                                                                                    SHA-256:8721FD01677570E770F1142AB468CD6F2E65DDE19DC03F64D54A57DF1EDEFE06
                                                                                                                                                                                    SHA-512:75986B7B0D83A9548838A8169B6F2FFAF682B454CDC6C1CAF0000866FD4A41180C764F5F73762916C37E27D6A8961E3BB7535EB8862FD9FCA74B7DCA2C2CCFBE
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{.. "short_name": "PCAppStore",.. "name": "PCAppStore",.. "icons": [.. {.. "src": "favicon.ico",.. "sizes": "24x24 64x64",.. "type": "image/x-icon".. },.. {.. "src": "favicon-16x16.png",.. "type": "image/png",.. "sizes": "16x16".. },.. {.. "src": "favicon-32x32.png",.. "type": "image/png",.. "sizes": "32x32".. }.. ],.. "start_url": ".",.. "display": "standalone",.. "theme_color": "#000000",.. "background_color": "#ffffff"..}

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\package.json

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2511
                                                                                                                                                                                    Entropy (8bit):4.786444073109678
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:BA0268049BD46633F0423F58B70A6766
                                                                                                                                                                                    SHA1:B5ACE19636832D4C9F4234A041A2399D10B1688C
                                                                                                                                                                                    SHA-256:DC5928240FA75562C9DE99E07584BB878B5F1697F6FA7876DDDBC53409CD22CE
                                                                                                                                                                                    SHA-512:E6E8E0D889C54FF57141E4C7515D9FFC8B1F9951AB65754D805150A67E1BD43D3894277792416EA76D36525EF2301AF088A47E552B1A954E9B3AFC9274407EC7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{.. "name": "pc_app_store",.. "version": "0.1.0",.. "private": true,.. "homepage": "/",.. "dependencies": {.. "@testing-library/jest-dom": "^5.14.1",.. "@testing-library/react": "^11.2.7",.. "@testing-library/user-event": "^12.8.3",.. "bezier-easing": "^2.1.0",.. "html-react-parser": "^1.2.7",.. "node-sass": "^6.0.1",.. "nw-react-scripts": "4.0.4",.. "prop-types": "^15.7.2",.. "react": "^17.0.2",.. "react-beautiful-dnd": "^13.1.0",.. "react-dom": "^17.0.2",.. "react-redux": "^7.2.4",.. "react-router": "^5.2.0",.. "react-router-dom": "^5.2.0",.. "redux": "^4.1.0",.. "redux-devtools-extension": "^2.13.9",.. "swiper": "^8.1.4",.. "web-vitals": "^1.1.2".. },.. "scripts": {.. "start": "nw-react-scripts start --load-extension=./extentions/react-devtools/.,./extentions/redux-devtools/.",.. "build": "nw-react-scripts build",.. "build-bin": "node build_bin_src.js",.. "test": "nw-react-scripts test",.. "eject": "nw-react

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\robots.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):70
                                                                                                                                                                                    Entropy (8bit):4.431168424936135
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:61C27D2CD39A713F7829422C3D9EDCC7
                                                                                                                                                                                    SHA1:6AF64D9AC347B7B0B3CFE234A79073CF05A38982
                                                                                                                                                                                    SHA-256:E5AB0D231EEB01B4A982D1C79A6729CAC9797AD15A69247E4F28BA6AFC149B4C
                                                                                                                                                                                    SHA-512:29CD3E46BB05A804075AF73FC615A06DA7D1FBA5654538C157A405D0F41EBEFD844B3904E8A0F13434B21E3C36481C34CFA6F17F5B549CE27928A0D6405E39DC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:# https://www.robotstxt.org/robotstxt.html..User-agent: *..Disallow:..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with very long lines (40486)
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):40538
                                                                                                                                                                                    Entropy (8bit):5.038776756689567
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:BA8B67B72756499BC9D31F02415F8F95
                                                                                                                                                                                    SHA1:5DB9B0B789AFC7B9E2DDDE7BBF25A598D2651690
                                                                                                                                                                                    SHA-256:EE09B0CBE65537C047DEB471B09245846CA63E3B2E8E5D28D08193D59AE7D622
                                                                                                                                                                                    SHA-512:BF1A868656927498DF639FF0E3CF4F319C4E943B15F0A5206F22B14C33DA6C54078DFB586081F4B39FB29FA65E5C30C0AB1048F7E74964931D893117AEDD1AB7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.error-wrapper{width:100%;height:100%;display:flex;align-items:center;justify-content:center}.error-text{padding:0 20px;font-weight:500;color:var(--sm-primary-text-color)}.in-background{width:100%;height:100%}.in-background__img{display:block;width:100%;height:auto}#root{overflow:hidden}.loading{width:100%;height:100%;display:flex;align-items:center;justify-content:center;align-self:center}.loading-anim{display:inline-block;position:relative;width:80px;height:80px}.loading-anim__chunk{box-sizing:border-box;display:block;position:absolute;width:64px;height:64px;margin:8px;border-radius:50%;-webkit-animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;animation:lds-ring 1.2s cubic-bezier(.5,0,.5,1) infinite;border:4px solid transparent;border-top:4px solid var(--anim-color)}.loading-anim__chunk:first-child{-webkit-animation-delay:-.45s;animation-delay:-.45s}.loading-anim__chunk:nth-child(2){-webkit-animation-delay:-.3s;animation-delay:-.3s}.loading-anim__chunk:nth-child(3){-webkit-ani

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\css\main.c1bf4e0a.chunk.css.map

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):75429
                                                                                                                                                                                    Entropy (8bit):5.131553566266101
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:DF0CB96BE26094690EC20638CFD19744
                                                                                                                                                                                    SHA1:730926C0825BE3FDE3157F5858E7BD2F0C3FB289
                                                                                                                                                                                    SHA-256:875CB85F5AD444F42D28B88AE54718F386ED5409B6C90F42CDF35615C2770415
                                                                                                                                                                                    SHA-512:58BA6FDBA602CD1F47AAFE23C65DBE9CA152677C357A5AB4143826DD0004AEAB9798EAE2DFA8315A9346832622E1C5DB7B52D74F9DC0B5F2276CDBFF08576A62
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"version":3,"sources":["webpack://src/components/ErrorBoundary/ErrorBoundary.scss","webpack://src/windows/Main/Main.scss","webpack://src/components/Loading/Loading.scss","webpack://src/components/InjectHTML/InjectHTML.scss","webpack://src/windows/StartMenu/StartMenu.scss","webpack://src/windows/Search/Search.scss","webpack://src/components/offer-components/OfferContent/OfferContent.scss","webpack://src/windows/Offer/Offer.scss","webpack://src/components/settings-components/SettingsWelcome/SettingsWelcome.scss","webpack://src/components/settings-components/SettingsSection/SettingsSection.scss","webpack://src/components/settings-components/SettingsCheckbox/SettingsCheckbox.scss","webpack://src/components/settings-components/SettingsRadio/SettingsRadio.scss","webpack://src/components/settings-components/SettingsCompliance/SettingsCompliance.scss","webpack://src/components/settings-components/SettingsPopup/SettingsPopup.scss","webpack://src/components/settings-components/SettingsNavigatio

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):673416
                                                                                                                                                                                    Entropy (8bit):6.007704985977014
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:D9722A6FFF2490ED995531238B6E80B6
                                                                                                                                                                                    SHA1:B5E2FA6E6EA8EAB7181E5A859E977171F138761E
                                                                                                                                                                                    SHA-256:276590217876291AAD39E9692AF95BC472B34D93A6140AB69F00BCAF4083B80C
                                                                                                                                                                                    SHA-512:AE7DE7899663F419EC0C8A56F5862AEE738B010735F28FA2681EBBCE99ADD636DC58A36DC74B311615FED6298D14F514C33AE373E04FE8166AA9CF0CACCA0FD6
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.........H...$..@..hF...........,T.....`&.......m.`......L`x....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`.....!.Lv............................................................................................Eo................................................................Eb.............Eg................................Eb.............Eb.............,T.4.`........`......L`.......^.......0a..........Kc........T.(.....f.... ........0.b...2.........$Sb............I`....Da>...........b.........,...L.....Ia........Db............D`........Q.`^........,..,T.4..`........m.`......L`.......^.......Xa..........Kc........T.(.....f.... ........8.b...2.........$Sb............I`....Da............b.........,...Le........@.................,T.X.`h.......`..... L`.....<Sb..............a.......!.b............I`....Da.........,T...`........`.....(L`.....0Sb.............!.`$.......`....Da....8.........)...........,T.<..`0.......m.`......L`..................

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):66
                                                                                                                                                                                    Entropy (8bit):4.884858891889049
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:ACAF465D1FBC096D21C487E89AD7C49F
                                                                                                                                                                                    SHA1:482DBE33E2BF02052800045CC293B0990742C234
                                                                                                                                                                                    SHA-256:FCD759D2C151212B5C1B806A584C3CAB0264BF3A27A84FA6D41A3D67EFC4AC5B
                                                                                                                                                                                    SHA-512:9BD7CD4109222774B02327FFED06E9F045587A0DF4070F013C4EE64647E829BC54329552DABF2C4000AB480BE5A27D0A2EE2F2522C8194239295F0E7641563AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:nw.Window.get().evalNWBin(null, "static/js/2.801b9d83.chunk.bin");

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.LICENSE.txt

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1686
                                                                                                                                                                                    Entropy (8bit):4.736390551286131
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:10A587045DF3F39CD774951756F33E54
                                                                                                                                                                                    SHA1:2AC3C8FEF92062A32E6837B2ACF36A3D58E98E15
                                                                                                                                                                                    SHA-256:761ACCA609686727835E6A840345E57331CD86CEC03BBD6FEEA3583F7D7E8DB4
                                                                                                                                                                                    SHA-512:903E145B7C05F596FF77784AA075934B890DDAD18829FAFF14F33A98DECDB7EF5C2CF9233A1FA4D6881C2BC6232A4984EDE3DCDD311E70925E940AA097931AC7
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:/*.object-assign.(c) Sindre Sorhus.@license MIT.*/../*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */../** @license React v0.20.2. * scheduler.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v16.13.1. * react-is.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-dom.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */../** @license React v17.0.2. * react-is.production.min.js.

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\2.801b9d83.chunk.js.map

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1024473
                                                                                                                                                                                    Entropy (8bit):5.423552162642971
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:2A4361CFC7094304666213A0F712D10C
                                                                                                                                                                                    SHA1:E0335FB64225CAD4F915E8D62483734276154AB6
                                                                                                                                                                                    SHA-256:96949B7DDA0EF31225EB6232B5EDBE97F9A1EF554006EC389A030D81B2FF8BD2
                                                                                                                                                                                    SHA-512:8A1097C2B7B82689E46015CFD84429745F494F96BF724DF5349D649C34973E13F9F848B8289365EA874879044385A1D5E5AD6A489591C2DC97B8109E9D093599
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"version":3,"sources":["../node_modules/react/index.js","../node_modules/react/jsx-runtime.js","../node_modules/@babel/runtime/helpers/esm/objectSpread2.js","../node_modules/prop-types/index.js","../node_modules/react-redux/es/components/Context.js","../node_modules/react-redux/es/utils/batch.js","../node_modules/react-redux/es/utils/Subscription.js","../node_modules/react-redux/es/utils/useIsomorphicLayoutEffect.js","../node_modules/react-redux/es/components/Provider.js","../node_modules/react-redux/es/components/connectAdvanced.js","../node_modules/react-redux/es/utils/shallowEqual.js","../node_modules/react-redux/es/connect/wrapMapToProps.js","../node_modules/react-redux/es/connect/mapDispatchToProps.js","../node_modules/react-redux/es/utils/bindActionCreators.js","../node_modules/react-redux/es/connect/mapStateToProps.js","../node_modules/react-redux/es/connect/mergeProps.js","../node_modules/react-redux/es/connect/selectorFactory.js","../node_modules/react-redux/es/connect/connec

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):16240
                                                                                                                                                                                    Entropy (8bit):5.4978991340628935
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:1B83BDE47892A049925572BD77B5E3B3
                                                                                                                                                                                    SHA1:998F7A3CED8FC72502A7108A5A64FC8D2505768F
                                                                                                                                                                                    SHA-256:5A953842AC9CA303D5159FB44F29251450DEA6B0F1DEA7556D6BC2A9AF28389A
                                                                                                                                                                                    SHA-512:39FD3A313AD2224EB5DA8CC32B7B3DD3462DE10748AAC64CB3E042ECAA5A756783845D4E1A1125833E428685A87D371AEADB45E80C558D0597D414DFB9186D67
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........'....$..@..P?...........,T.h..`........m.`..... L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`........c................C.,T.I..`B.......`......L`D.....Sb........2.....!...!...a.......!...........a......!......a.................!...!.............a...a.........x......................................................................................................Rb........124.`....Da.....!....a......Rc.s......getCLS...,T.(.`........`....]......Ha..........Kb.......... .c.................(Sb...........I`....Da....2....8....L.....Ia........Db............D`.......Q.`p........(..D..,T.(..`........m.`....]......ha..........Kb.......... .c.................(Sb...........I`....Dah........8....\e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da...........e........@.................,T.(.`........`....].....a..........Kb.......... .c.................(Sb...........I`....Da

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):66
                                                                                                                                                                                    Entropy (8bit):4.8128151418562695
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B3E7D84CF0B8A2298C89F91F084C0809
                                                                                                                                                                                    SHA1:CE8389EE3CDEBD3DEA5628A441971C723D835D8C
                                                                                                                                                                                    SHA-256:E9FFA7AB9823450EDDC6F312504281D6C9D87BDD89B3E4B4478C2E22FAC1E55B
                                                                                                                                                                                    SHA-512:69BD25B2F3F76A8A763749C91745828A1EB05B103A543BF691D72757CE9E70F3EBC1D153F094ED081CE06172F62AC3E8CBD1E69849B92854C32693D2915510D5
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:nw.Window.get().evalNWBin(null, "static/js/3.cf9f4ce6.chunk.bin");

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\3.cf9f4ce6.chunk.js.map

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):9898
                                                                                                                                                                                    Entropy (8bit):5.1083863257804785
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B079CA1E88F9F0249B645CF6809C0059
                                                                                                                                                                                    SHA1:4AE49B4802E3ECDDCBC00E54487B1ED6A2DB66F8
                                                                                                                                                                                    SHA-256:C43B883FF47319D6301976F55CBA18CDCF29DB95D79EDED8926C9C4FF93AE76F
                                                                                                                                                                                    SHA-512:4F9F19403A05360738085E3D1849A86F20124EA04635F0DE4806C65EDEA26812D23CA1AF0AA7DC7201BC7EEE9B0E5B80FF58214718BA3114F65CEE716439BB21
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"version":3,"sources":["../node_modules/web-vitals/dist/web-vitals.js"],"names":["e","t","n","i","a","name","value","delta","entries","id","concat","Date","now","Math","floor","random","r","PerformanceObserver","supportedEntryTypes","includes","self","getEntries","map","observe","type","buffered","o","document","visibilityState","removeEventListener","addEventListener","c","persisted","u","WeakSet","Set","f","has","s","hadRecentInput","push","takeRecords","m","p","v","timeStamp","d","setTimeout","l","disconnect","startTime","add","performance","getEntriesByName","requestAnimationFrame","h","passive","capture","S","y","w","g","entryType","target","cancelable","processingStart","forEach","E","L","T","once","b","getEntriesByType","timing","max","navigationStart","responseStart","readyState"],"mappings":"8GAAA,+MAAIA,EAAEC,EAAEC,EAAEC,EAAEC,EAAE,SAASJ,EAAEC,GAAG,MAAM,CAACI,KAAKL,EAAEM,WAAM,IAASL,GAAG,EAAEA,EAAEM,MAAM,EAAEC,QAAQ,GAAGC,GAAG,MAAMC,OAAOC,KAAKC,MAAM,KAAKF,OAAOG,KAAKC,MAAM,cAAc

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):465368
                                                                                                                                                                                    Entropy (8bit):6.14942830048273
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:5D4D79F5E8C4C5BE596D0D29FE390DB8
                                                                                                                                                                                    SHA1:BE21E4FB8E1068A14754A02BD6189A38240B0047
                                                                                                                                                                                    SHA-256:6F0FE0DF3138C4D6793991EA974B6F63F982F86652E8DDFC4E33EE70A5EFB88C
                                                                                                                                                                                    SHA-512:20CC4165405DC4E0EDEC3AC1713973EB94DAAAAF26EA6CB5FC9EB59321DC85583182916E125744D4C85FAD26F89C1CF08EA8A7F67C036F3BED5571157EBF3035
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.............$..@...............,T.]...`l.......m.`.....5.L`.....!..$Rg.......webpackJsonppc_app_store..........`......L`.......`......Ma........`.......`......L`.......`......Mc...........................`.......La..........Ec.................E`.....Eg.................................E...........................................................................................................................................................................................................................,T.8.`".......`......L`......Rc.b.....require...Rb........fs.....^.......@a..........Kc..........(...8.g............!......b...2.........$Sb............I`....Da............b.......... ..L.....Ia........Db............D`........Q.`l........<..,T.8..`".......m.`......L`.....L..Rb.2M....net....^.......pa..........Kc..........(...<.g............!......b...2.........$Sb............I`....DaB...........b.......... ..de..........................,T.8.`".......`......L`.......Rb...h....http...^..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):69
                                                                                                                                                                                    Entropy (8bit):4.8761250011309585
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:99282C810B1320DD7DDF3F1E3C49BCB3
                                                                                                                                                                                    SHA1:412001989210C2675F1F0F6867E7B76243D37B31
                                                                                                                                                                                    SHA-256:77E053252D75F968C929769601E19EA05BBBB628307B99B23DBFE6DA511F9936
                                                                                                                                                                                    SHA-512:953288399F2B8E45D37A8BBEF6D48725F303143E144077C265346A0D900AB1AE8FE8A22B543BC32E8E37C80C840ED1AEBA6C0CC603B0DE126EFFE92B194166AA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:nw.Window.get().evalNWBin(null, "static/js/main.717b6389.chunk.bin");

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\main.717b6389.chunk.js.map

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):703789
                                                                                                                                                                                    Entropy (8bit):5.361726899305513
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:2A430BD7263C0FF637BCE16595B14F25
                                                                                                                                                                                    SHA1:1DDA5EB0085930E7F36C947799D7806F08C73D4B
                                                                                                                                                                                    SHA-256:1095AB40B990F5B4BB57121D8A0DFA575D727B2BA227576260496C1F1E39CFA3
                                                                                                                                                                                    SHA-512:340521BC1857EF3A8CF9EF2A247AD89C52BB481DAEA26200C23614D42D0BDC09EAD66356E7FA0D46C7EE1687125C5CAC4B2EC40E43DD863256A3894224317CA1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"version":3,"sources":["../external \"fs\"","../external \"net\"","../external \"http\"","../external \"https\"","../external \"path\"","store/actionTypes/appActionTypes.js","store/reducers/appReducer.js","store/actionTypes/windowsActionTypes.js","store/reducers/windowsReducer.js","store/actionTypes/startMenuActionTypes.js","store/reducers/startMenuReducer.js","store/actionTypes/settingsActionTypes.js","store/reducers/settingsReducer.js","store/actionTypes/searchActionTypes.js","constants.js","store/reducers/searchReducer.js","store/actionTypes/offerActionTypes.js","store/reducers/offerReducer.js","store/actionTypes/topbarActionTypes.js","store/reducers/topbarReducer.js","store/actionTypes/notificationsActionTypes.js","store/reducers/notificationsReducer.js","store/actionTypes/widgetActionTypes.js","store/reducers/widgetReducer.js","store/reducers/rootReducer.js","store/store.js","store/actionCreators/appActionCreators.js","store/actionCreators/windowsActionCreators.js","store/actionC

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.bin

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6880
                                                                                                                                                                                    Entropy (8bit):5.780693101615468
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:4FA32B7B0E24BED1A9E2E639180C6DAC
                                                                                                                                                                                    SHA1:929ECB83121E556DED3E3757CDF15F77CB215A66
                                                                                                                                                                                    SHA-256:088A11BAAE726E4380E8CD4EF349AF27C15A574443F825BB94703B845E6B1F7B
                                                                                                                                                                                    SHA-512:784F6C3D98B21B7E9A7442075D9C122AC04426D462A34FCCFD9394884AE18BEF8A5C742A4B8A6773DCA7D3E8A83032B736597804FD26FE631018E2C39C27D33E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:........>....$..@...............,T.4..`........m.`......L`.....,T....`........`.....xL`8....\Sb..............!......a.......!...!....f$...........................I`....Da.........,T.-..`........`.....(L`..............................B...........(a.........xK|.....`.H...................8......c.(.<...0.......#.H..................(.<...H.............(.....{....$... ...<........x............/...../...../.....}..-...n...Y../...!...-....-....-......._......$...../....-........./..../...^........4.. ..P"..\.#...Iw...$.....;....$.-.!...-....-..%.-..'._....)......./.+.4..-...:./.......b..0-..2..-..4.]..6.a.8...:...-....-..;........}=._....>...a.@...(Sb.............a.`....Da....P.... .8..lB........ ........P...... ...../..........P...p.`.@..L.....Ia........Db............D`.....T.Q.`&...........$..,T....`........m.`......L`.........r............Pa.........HKp~.......<.......d...........T.........?........!..<. ........g.... ...P................-...n...q...../........-...n...#../.......

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):71
                                                                                                                                                                                    Entropy (8bit):4.7442478245494595
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:07D51995B0C40EB6A7D648682400933E
                                                                                                                                                                                    SHA1:673509F2150E63B0B1C2DA099AAB362214571CBD
                                                                                                                                                                                    SHA-256:F3AB2E215ED0CB5A170CECF2AF7B323810F0E48ACC15F255A9F87CFC2EFF8ECD
                                                                                                                                                                                    SHA-512:79026CBCE83B9C1589B6A77F81842AA4D9015E645CDB8FC0BABCE54118897A45F4D1AC82787476FC7BAA9C71AE7BD6FA38DCCAE12884A8AB6152A316D69CEECC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:nw.Window.get().evalNWBin(null, "static/js/runtime-main.cdd4f9cc.bin");

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\js\runtime-main.cdd4f9cc.js.map

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):12604
                                                                                                                                                                                    Entropy (8bit):5.32907166018772
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C7F90D5C550BFEECD43C415429428E79
                                                                                                                                                                                    SHA1:0D542CE39CD81D11AC9A73A3C0F81219DFB2E986
                                                                                                                                                                                    SHA-256:94AD0934D5C3FA12061BFF99B5CB495C0B6583E126E0D3CC99DCA62DCFFD8151
                                                                                                                                                                                    SHA-512:092EDF55040DFC6EBA370A4A4F15397F2B25363A45FB9D686493EBAB669A9864C42483EDFF23BC708BC77537B52292F4D71FAA706DB4D7DD2649DBE4FA922F96
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:{"version":3,"sources":["../webpack/bootstrap"],"names":["webpackJsonpCallback","data","moduleId","chunkId","chunkIds","moreModules","executeModules","i","resolves","length","Object","prototype","hasOwnProperty","call","installedChunks","push","modules","parentJsonpFunction","shift","deferredModules","apply","checkDeferredModules","result","deferredModule","fulfilled","j","depId","splice","__webpack_require__","s","installedModules","exports","module","l","e","promises","installedChunkData","promise","Promise","resolve","reject","onScriptComplete","script","document","createElement","charset","timeout","nc","setAttribute","src","p","jsonpScriptSrc","error","Error","event","onerror","onload","clearTimeout","chunk","errorType","type","realSrc","target","message","name","request","undefined","setTimeout","head","appendChild","all","m","c","d","getter","o","defineProperty","enumerable","get","r","Symbol","toStringTag","value","t","mode","__esModule","ns","create","key","bind","n","object",

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\copy_icon.570b8027.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1370
                                                                                                                                                                                    Entropy (8bit):5.283353360674453
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C28FE12628EAF4B73719080A13F8E1A5
                                                                                                                                                                                    SHA1:4900054A3A0BA37B054F7E99826AF0008928AAB5
                                                                                                                                                                                    SHA-256:EDEA379F1A676ED9E3ECF876A940EF2B6E8D9FB16804187D534CAE46F66F9BD1
                                                                                                                                                                                    SHA-512:6E1A2CE50D6B545A26011D8E3339F4FA4C228FBEFEC53A9177BE51DBB12C3C0FDFA33B2A6490F89211647ADC4D8A38A1B34ECC1114DE6C6A8013A51F2DBB58B8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="iso-8859-1"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Capa_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 210.107 210.107" style="enable-background:new 0 0 210.107 210.107;" xml:space="preserve">..<g>...<path style="fill:#c3c3c2;" d="M168.506,0H80.235C67.413,0,56.981,10.432,56.981,23.254v2.854h-15.38....c-12.822,0-23.254,10.432-23.254,23.254v137.492c0,12.822,10.432,23.254,23.254,23.254h88.271....c12.822,0,23.253-10.432,23.253-23.254V184h15.38c12.822,0,23.254-10.432,23.254-23.254V23.254C191.76,10.432,181.328,0,168.506,0z.... M138.126,186.854c0,4.551-3.703,8.254-8.253,8.254H41.601c-4.551,0-8.254-3.703-8.254-8.254V49.361....c0-4.551,3.703-8.254,8.254-8.254h88.271c4.551,0,8.253,3.703,8.253,8.254V186.854z M176.76,160.74

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_calculator_gray.f29de877.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):5175
                                                                                                                                                                                    Entropy (8bit):3.933853115875902
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:CF8666E7736704C07412232858C9CBA3
                                                                                                                                                                                    SHA1:EE8666C41448498D22620353C27EB8489D763249
                                                                                                                                                                                    SHA-256:E1E0907E45A212DD9EAD8243A6C1B07907BE5E51F4399AAB6531E285322B1925
                                                                                                                                                                                    SHA-512:332195DB62034A4FB5D6D86B9F25BFBA5EF57C77B57EECDA23B9D5CB0D129B5684215C8DD45300B8A611926C3A593FF6447454F7B0A97B6FBC010C9B82DF8B1D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M1.16071 0C4.77679 0 8.37054 0 11.9866 0C12.0089 0 12.0089 0.0223228 12.0312 0.0223228C12.7232 0.156251 13.1696 0.647323 13.1696 1.36161C13.1696 5.44643 13.1696 9.55357 13.1696 13.6384C13.1696 14.4196 12.5893 15 11.808 15C8.32589 15 4.84375 15 1.36161 15C1.16071 15 0.937499 14.9554 0.758927 14.8661C0.223213 14.6205 0 14.1741 0 13.5938C0 10.8705 0 8.14732 0 5.42411C0 4.08482 0 2.72322 0 1.38393C0 0.959823 0.156249 0.580358 0.491071 0.3125C0.669642 0.133929 0.915178 0.0446429 1.16071 0ZM12.2768 7.47768C12.2768 5.46875 12.2768 3.4375 12.2768 1.42857C12.2768 1.02679 12.1205 0.870536 11.7188 0.870536C8.28125 0.870536 4.84375 0.870536 1.42857 0.870536C1.02678 0.870536 0.870534 1.02679 0.870534 1.42857C0.870534 5.46875 0.870534 9.50893 0.870534 13.5491C0.870534 13.9509 1.02678 14.1071 1.42857 14.1071C4.86607 14.1071 8.30357 14.1071 11.7188 14.1071C12.1205 14.1071 12.2768 13.9509 12.2768 1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_calculator_white.cdac319f.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2823
                                                                                                                                                                                    Entropy (8bit):4.491649868709728
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:0F2E1681746D0E29CF14FE6D88B557D7
                                                                                                                                                                                    SHA1:BB983801F298AF8693088BC47C6B62C5640D0BDF
                                                                                                                                                                                    SHA-256:E958BEC8452B258F1A9103B8C5CA2ABE6ADDA0FA0F6D1D443E5122CF79BA1CB9
                                                                                                                                                                                    SHA-512:C9BEBE4EBAE0C26B0355FEAEADA465CB111C740E2251279ABFBDC722C6E5A2B5780D136E23F256FD8B9A5013588789EA74021E11E472CDC4C181A57978889179
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 14 15" style="enable-background:new 0 0 14 15;" xml:space="preserve">..<style type="text/css">....st0{fill:#FFFFFF;}..</style>..<g>...<path class="st0" d="M1.2,0C4.8,0,8.4,0,12,0c0,0,0,0,0,0c0.7,0.1,1.1,0.6,1.1,1.3c0,4.1,0,8.2,0,12.3c0,0.8-0.6,1.4-1.4,1.4....c-3.5,0-7,0-10.4,0c-0.2,0-0.4,0-0.6-0.1C0.2,14.6,0,14.2,0,13.6c0-2.7,0-5.4,0-8.2c0-1.3,0-2.7,0-4C0,1,0.2,0.6,0.5,0.3....C0.7,0.1,0.9,0,1.2,0z M12.3,7.5c0-2,0-4,0-6c0-0.4-0.2-0.6-0.6-0.6c-3.4,0-6.9,0-10.3,0C1,0.9,0.9,1,0.9,1.4c0,4,0,8.1,0,12.1....c0,0.4,0.2,0.6,0.6,0.6c3.4,0,6.9,0,10.3,0c0.4,0,0.6-0.2,0.6-0.6C12.3,11.5,12.3,9.5,12.3,7.5z"/>...<path class="st0" d="M6.6,1.8c1.4,0,2.9,0,4.3,0c0.4,0,0.5,0.2,0.5,0.5c0,1.1,0,2.3,0,3.4c0,0.4-0.2,0.5-0.5,0.5....c-2.9,

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_check_gray.fc098a35.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):854
                                                                                                                                                                                    Entropy (8bit):4.266600052838456
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:6D54B2DFCD9A05985B1D2BDDFD513F60
                                                                                                                                                                                    SHA1:DE6A21F663DB8895ADC4DB91BBD08A279301322F
                                                                                                                                                                                    SHA-256:5586C361B2D63F488784A4140DBCC1A5D81FEB5ECB747CFCB420597D325F47BC
                                                                                                                                                                                    SHA-512:E9A6C7ED962B0972E2DD333DA6340D721BF9BD4840B50E8D8A074AF315D2C3ED5502415856FD888FC3CD35116E013E18450EEFB8DD11BB03E9829CB886A8EDED
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="#444444"/>..</svg>..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_check_white.f080410d.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):852
                                                                                                                                                                                    Entropy (8bit):4.275850671375772
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:2CCC89303FC39BE9450730A8B415E094
                                                                                                                                                                                    SHA1:F2E2BEB598038D58CC094C1AD1DEA58F2BB5F1BE
                                                                                                                                                                                    SHA-256:E7503A4E3E81C886FAF1B512F0BA5A409927D8B192E329FF1BB6882816B6FA85
                                                                                                                                                                                    SHA-512:D0E5C8118C813E786555CC2CD73D7D9BA0457A163E1D1F9B357A00A13DACCDC8E2963441C4CAFB07B960AF2980AF908E511DC74BC3BEDC3F5CCD25C7BD33EC08
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="20" height="16" viewBox="0 0 20 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20 1.27078C19.8339 1.53302 19.6923 1.81505 19.492 2.04761C15.6234 6.5403 11.7451 11.0231 7.87163 15.5109C7.43202 16.0205 6.90938 16.1392 6.42092 15.8325C6.31346 15.7632 6.21577 15.6692 6.12785 15.5752C4.19356 13.4971 2.26904 11.409 0.334758 9.33092C-0.310005 8.63822 0.0514528 7.68327 0.784137 7.50515C1.13583 7.42103 1.45821 7.48535 1.73174 7.73275C1.85386 7.8416 1.96132 7.9653 2.07366 8.08405C3.66603 9.80592 5.26328 11.5278 6.85565 13.2497C6.88007 13.2744 6.89472 13.2991 6.9338 13.3437C7.00707 13.2596 7.07545 13.1903 7.13407 13.1161C10.7877 8.89551 14.4414 4.66505 18.0901 0.434588C18.5737 -0.124525 19.3162 -0.149265 19.7509 0.390057C19.8632 0.528598 19.917 0.711671 20 0.870004C20 1.00855 20 1.13719 20 1.27078Z" fill="white"/>..</svg>..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_gray.c8a9351b.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4743
                                                                                                                                                                                    Entropy (8bit):3.9546492458044593
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:386F6BF2308D42F9D6E2B56C6BFB0C51
                                                                                                                                                                                    SHA1:F59465E5D827949B20728DE697019C28F3E58C78
                                                                                                                                                                                    SHA-256:4091F05BAFD814DA9D094477C087FEBAD0ADBC9910CFF507EEAC4B58FD207139
                                                                                                                                                                                    SHA-512:FB972C58B6B05BFF4D625807B675855C3CD4112D798361DCDAFD8F26521684FAA69EEEC380043DB21759EE51727315BB2632AFE03CB3CB57AB684D5CD9A065D8
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_clipboard_white.2afacb39.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4729
                                                                                                                                                                                    Entropy (8bit):3.9826071199242548
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:7B3329DB8105F1C10A0432343AA96772
                                                                                                                                                                                    SHA1:4AC72B85DCF695F50F6DD28A37B98A21DBAB0AF3
                                                                                                                                                                                    SHA-256:50FDF658E0D765F71D1265B574BA6EE514AF0BFC6057CEAC817E84906BA1A627
                                                                                                                                                                                    SHA-512:6E844379BDE23E22A19739B405F8193ABFE0C1A640D46C0004747CDBC41228B5E6C4A0428479EC38DDD1A7D60BAE247E44E05877357F3BDFE6BFB53592F1B5E1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="11" height="15" viewBox="0 0 11 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.19271 0C8.45052 0.0894632 8.65104 0.238569 8.73698 0.53678C8.76563 0.626243 8.76563 0.745525 8.76563 0.864809C8.88021 0.864809 8.99479 0.864809 9.08073 0.864809C9.33854 0.864809 9.59635 0.864813 9.82552 0.924455C10.513 1.07356 10.9714 1.72962 11 2.44533C11 2.80318 11 3.16103 11 3.51889C11 6.76938 11 10.0497 11 13.3002C11 13.9861 10.7135 14.5229 10.112 14.8509C9.91146 14.9404 9.68229 15 9.45313 15C6.81771 15 4.18229 15 1.51823 15C0.658851 15 0 14.2843 0 13.3598C0 11.004 0 8.61829 0 6.26242C0 5.03976 0 3.78728 0 2.56461C0 1.84891 0.286453 1.31213 0.916662 1.01391C1.11718 0.924451 1.375 0.89463 1.60417 0.864809C1.80469 0.834988 2.03385 0.864809 2.26302 0.864809C2.26302 0.805167 2.26302 0.745525 2.26302 0.715704C2.29167 0.387672 2.4349 0.149107 2.72135 0.0298229C2.75 0.0298229 2.77864 0 2.80729 0C4.64062 0 6.41667 0 8.19271 0ZM2.29167 1.75944C2.09115 1.75944 1.89062 1.75944 1.6901 1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_cross_gray_2.01bfd543.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1592
                                                                                                                                                                                    Entropy (8bit):4.004290849514056
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:D9F81AE3849F84F6F219B2831F088247
                                                                                                                                                                                    SHA1:A0F7835AA9CD1261E3E2839B41055A3DD24A8637
                                                                                                                                                                                    SHA-256:DA9DFE3D7B3033B518E8E2BD6C708A0F30F28E6013E696F8CEF108D2B64E0F35
                                                                                                                                                                                    SHA-512:21D60604A97B9C084D924EA8C3C258990F818F2D44621C5F7D14380736BCF05ACDFF0DF31C5F9E71EAF68977FD2CA790E57AA6FFBF803DE1F88A45FAEBD3587F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_cross_white_2.05921d5e.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1590
                                                                                                                                                                                    Entropy (8bit):4.012220474436418
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:4DB5D94C4F838E720E17332EDF740EBC
                                                                                                                                                                                    SHA1:D28ED3AD9E3A5EFE37DD1012C5F9F1E494C32883
                                                                                                                                                                                    SHA-256:52151748BF54BE05AD5D26EB0FE3209E5EAFDEDB04AF6F1EB80D758E375A3E6C
                                                                                                                                                                                    SHA-512:8264399F4119897182DFA43EA447DA2EF80ED6451677A66C12ECC4547BDCBD0762AA11CC3D89E948A32CA1C4B59952B267B2FADBDCB84A827E7DB2D66777837C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.930186 15.0723C0.877158 14.88 0.80093 14.6911 0.784359 14.4956C0.761161 14.1741 0.933506 13.9288 1.15225 13.7101C2.94199 11.9204 4.73173 10.1306 6.52146 8.34088C6.58112 8.28122 6.64078 8.22156 6.72032 8.14202C6.65072 8.07242 6.59438 8.01608 6.53472 7.95642C4.77152 6.19322 3.01494 4.42338 1.24511 2.67344C0.800997 2.23595 0.638599 1.78189 0.933576 1.20851C1.02638 1.11571 1.11918 1.02291 1.20866 0.933425C1.4009 0.880395 1.58981 0.804165 1.78535 0.787593C2.10684 0.764391 2.3521 0.936733 2.57085 1.15548C4.36056 2.94519 6.15028 4.73491 7.94331 6.52795C8.00297 6.5876 8.06263 6.64726 8.14217 6.7268C8.21177 6.6572 8.26812 6.60086 8.32777 6.5412C10.1275 4.74152 11.9271 2.94184 13.7268 1.14216C14.1312 0.73781 14.6151 0.671521 15.0525 0.943292C15.5165 1.23495 15.6458 1.88787 15.3309 2.3353C15.258 2.43473 15.1752 2.52422 15.0857 2.61371C13.3092 4.39019 11.5327 6.16667 9.75623 7.94315C9.69658

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_gray.3a181243.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4264
                                                                                                                                                                                    Entropy (8bit):3.894045254391696
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:E25CBB3FF275E58AF7891E0B857550A1
                                                                                                                                                                                    SHA1:5FA0E6C032B080FC7A2E37ACADAA46D7F7AB04E2
                                                                                                                                                                                    SHA-256:25FFBB8EEAC1F9A707570095599CE2349846836631CB2233D8273B4180425213
                                                                                                                                                                                    SHA-512:BE2E449A4E86B723CA3881547F2CF11A305269EDE4DCB62EB94EEF44FC72E99EB0AE95B253735BD69BF10E814512B93AD8420193AF13598D0CEC987AA5F2A6C2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="20" height="21" viewBox="0 0 20 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.7624L19.9644 10.7985C19.7505 11.593 19.2514 11.9903 18.4315 11.9903C16.542 11.9903 14.6525 11.9903 12.763 11.9903C12.6204 11.9903 12.5135 11.9903 12.3709 11.9903C11.4796 11.9903 10.8379 11.3402 10.8379 10.4374C10.8379 9.78739 10.8379 9.17347 10.8379 8.52344C10.8379 6.32057 10.8379 4.1538 10.8379 1.95092C10.8379 0.903652 11.1231 0.506411 12.0857 0.181396C14.3316 0.181396 16.542 0.181396 18.788 0.181396C19.1088 0.289735 19.4653 0.434186 19.6436 0.723088C19.7862 0.939764 19.8575 1.19255 19.9644 1.44534C20.0001 4.58715 20.0001 7.69285 20.0001 10.7624ZM18.7523 6.14C18.7523 4.69549 18.7523 3.28709 18.7523 1.84258C18.7523 1.55368 18.7167 1.51757 18.4315 1.51757C16.435 1.51757 14.4386 1.51757 12.4422 1.51757C12.157 1.51757 12.0857 1.55368 12.0857 1.84258C12.0857 4.69549 12.0857 7.58451 12.0857 10.4374C12.0857 10.7263 12.157 10.7985 12.4422 10.7985C14.4386 10.7985 16.435 10.7985

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_dashboard_white.a91ae220.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4238
                                                                                                                                                                                    Entropy (8bit):3.914834455290012
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:2A64F22D46EF697D361BC13F4E5EC382
                                                                                                                                                                                    SHA1:8F4277EA88024B458509538814E3A50BD20F0F04
                                                                                                                                                                                    SHA-256:33629801FE35C15E2803A47C1ED0B8E21F38114119F05D64EBD65E5DA246B7CA
                                                                                                                                                                                    SHA-512:6A9FC6FC4526D36FC259BF104F35418FB0914E32314975666E8EF01BC1D940263CC2F3109051E112A26A7FE42895762729F3FF5DC1E4C6D8ADF2A0E1CFD410E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M20.0001 10.4456L19.9644 10.4813C19.7505 11.2656 19.2514 11.6578 18.4315 11.6578C16.542 11.6578 14.6525 11.6578 12.763 11.6578C12.6204 11.6578 12.5135 11.6578 12.3709 11.6578C11.4796 11.6578 10.8379 11.016 10.8379 10.1248C10.8379 9.48307 10.8379 8.87701 10.8379 8.23529C10.8379 6.06061 10.8379 3.92157 10.8379 1.74688C10.8379 0.713012 11.1231 0.320856 12.0857 0C14.3316 0 16.542 0 18.788 0C19.1088 0.106952 19.4653 0.249554 19.6436 0.534759C19.7862 0.748663 19.8575 0.998217 19.9644 1.24777C20.0001 4.34938 20.0001 7.41533 20.0001 10.4456ZM18.7523 5.88235C18.7523 4.45633 18.7523 3.06595 18.7523 1.63993C18.7523 1.35472 18.7167 1.31907 18.4315 1.31907C16.435 1.31907 14.4386 1.31907 12.4422 1.31907C12.157 1.31907 12.0857 1.35472 12.0857 1.63993C12.0857 4.45633 12.0857 7.30838 12.0857 10.1248C12.0857 10.41 12.157 10.4813 12.4422 10.4813C14.4386 10.4813 16.435 10.4813 18.4315 10.4813C18.7167

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_gray.d7229273.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6098
                                                                                                                                                                                    Entropy (8bit):3.8868971852897896
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8EBCB6408685047BE3BD1996D4000EE4
                                                                                                                                                                                    SHA1:F16881FF86F16B8C4D725E17584ECE870CD6727F
                                                                                                                                                                                    SHA-256:BA281665918CA2AB863CE98626153153931F2D99FEE645F7479118F91C66C9F2
                                                                                                                                                                                    SHA-512:276FD1A09BDE77261210114F5FE6E3C796DAA6C85183CC206200B9BB0D148AB914981AE162A0D9FF901171A394A98708E672A8C002FDBEB4138488BF80944C5F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_gamepad_white.25a7995d.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6086
                                                                                                                                                                                    Entropy (8bit):3.9063223215918432
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:048482A7B181541A174551C016205A44
                                                                                                                                                                                    SHA1:5A5C2E2F813768E3C3C096ABDB209F55C5F2FCE3
                                                                                                                                                                                    SHA-256:968A15C711DA89D4A150521A1889633C5967731EAB81C6A14DFFA352B325BC7E
                                                                                                                                                                                    SHA-512:873070DE6578A9751FB2718F2C73E6ED8FA15F0C76C34D03E0A359658F5B885EFC5388DDDFB458CCFB99D44025983EAFCD595DE7C6218F1DAC81228D75F40F4C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="16" height="11" viewBox="0 0 16 11" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M16 8.62987C15.9472 8.92217 15.9117 9.21777 15.8394 9.50569C15.7505 9.90773 15.5371 10.275 15.2269 10.56C14.6695 11.057 13.8597 11.138 13.1554 10.7669C12.6421 10.4875 12.1924 10.1131 11.8329 9.66553C11.4245 9.17616 11.0495 8.66271 10.6675 8.15364C10.6453 8.11432 10.6121 8.08164 10.5716 8.05922C10.5311 8.0368 10.4849 8.02553 10.4381 8.02664C8.81238 8.03102 7.18705 8.03102 5.5621 8.02664C5.51686 8.02284 5.47145 8.03194 5.43163 8.0528C5.39182 8.07365 5.35938 8.10532 5.33844 8.14378C4.90194 8.82765 4.38931 9.46449 3.80946 10.0432C3.47452 10.3927 3.06867 10.6735 2.61655 10.8687C2.2413 11.0212 1.82147 11.0416 1.43196 10.9261C1.04246 10.8106 0.708611 10.5667 0.489974 10.2381C0.217225 9.81192 0.0595757 9.32778 0.0311659 8.82912C-0.0766541 7.71682 0.109163 6.6286 0.375272 5.55243C0.728555 4.12921 1.22177 2.74649 1.97078 1.46231C2.19701 1.09466 2.45605 0.746321 2.74502 0.421172C2.85915 0.287

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_gear_gray.545673b6.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6801
                                                                                                                                                                                    Entropy (8bit):3.7386877939405805
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:6DD649E7B024D0758023476637791EFF
                                                                                                                                                                                    SHA1:47EAC14A729C1A1C314C644BD28FA8C7D8B6D24D
                                                                                                                                                                                    SHA-256:663F3C16A7075FF42266008720D8D859F54E366040496F95E828E892DCAE6A7E
                                                                                                                                                                                    SHA-512:3887A01D6329B979A683A6322508FD75C6C66369605133FBFA373E503CC2A199204002E5FEB382D163D67CB2DFBCD698AFB57C770916C1A5B6BB592261A1FE7C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_gear_white.2bba31c1.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):6797
                                                                                                                                                                                    Entropy (8bit):3.744755737482207
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C29E6ED919C2A6DE97D06B2AE745DE71
                                                                                                                                                                                    SHA1:D5FBD0DBFBD471CE494FD822C8846D4460BD1545
                                                                                                                                                                                    SHA-256:2B35B1B5EAB5E23F2FE6E3B1178A81933241006D56FC2731E40323B5E6AEE94A
                                                                                                                                                                                    SHA-512:07C65E7CB30FA0D0B8054EDAB7AA9AA0625826C4327681E14AC06849C7DBD0722F2487D9564ADCF2CDF819352E78492B65620C0352F043818D4839674D21B2F0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.56484 0C10.1938 0 10.8227 0 11.4516 0C11.4734 0.0109432 11.4953 0.0273583 11.5227 0.0328299C12.3539 0.207921 12.9336 0.798855 13.0703 1.63054C13.1031 1.82204 13.0977 2.02449 13.0922 2.22147C13.0922 2.33637 13.125 2.38562 13.2344 2.42392C13.4859 2.51147 13.732 2.60995 13.9781 2.71391C14.1203 2.7741 14.2734 2.90542 14.4047 2.88901C14.5305 2.86712 14.6344 2.6975 14.7492 2.58807C15.5203 1.86582 16.6469 1.8494 17.418 2.57165C17.7789 2.90542 18.1289 3.2556 18.457 3.61673C18.8891 4.09276 19.0367 4.65633 18.9164 5.29104C18.8398 5.71782 18.6156 6.06253 18.3094 6.358C18.0742 6.58781 18.0797 6.58781 18.2109 6.8778C18.3148 7.10761 18.4133 7.34289 18.5008 7.57817C18.6266 7.91193 18.6211 7.91193 18.9766 7.91193C19.8516 7.91741 20.5461 8.35513 20.8523 9.11569C20.9125 9.25795 20.9508 9.41115 21 9.55889C21 10.1881 21 10.8174 21 11.4466C20.9836 11.4904 20.9672 11.5341 20.9563 11.5779C20.8141 12.1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_notification_gray.e0145c50.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3605
                                                                                                                                                                                    Entropy (8bit):3.914389459303166
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:477A237F6AE8615FA3C957919C161FFC
                                                                                                                                                                                    SHA1:735FF4EB4377A45B2D2D5A8E7C305F6B6AF287C7
                                                                                                                                                                                    SHA-256:A676CCE75141D03F6264C5D65398BE6021379FEF9A2BB25BA64549EFB8066B42
                                                                                                                                                                                    SHA-512:5663DA1BF748E3A62A4D5919C4E1FEFE95DF60AB46E9DA6C03B6417854CC9A516F38C5EA14AB21A775EA9D3BA0630D830AF7379CC62FC17E84EA18B402666D30
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="#494444"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_notification_white.addda272.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3599
                                                                                                                                                                                    Entropy (8bit):3.928807214825618
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:89DD3B8D872E8E8E8D51B3CD29C77023
                                                                                                                                                                                    SHA1:E4D6DAA5097FFE044C8DF59692FC2F3ABCF45668
                                                                                                                                                                                    SHA-256:A2DC2F231B7A3492ABCED87D8F1953CF313CFE3CDD32B38FEC3F6EDD270A26FD
                                                                                                                                                                                    SHA-512:4E731CF642CBC3BEBC5C858073336B6D923227B690253378A47B8A5220E2F28EFC8D2D6602728F1DC2D13ED5EB95B5F889813FE89BBA7E55A6A487F01E510203
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="14" height="15" viewBox="0 0 14 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M13.98 6.12847C13.98 6.2105 13.9925 6.29644 13.9759 6.37457C13.9344 6.59722 13.7107 6.75347 13.4828 6.73394C13.2424 6.71441 13.0601 6.53082 13.0559 6.28863C13.0476 5.76519 12.9813 5.24957 12.828 4.74175C12.5504 3.82379 12.0614 3.0191 11.3611 2.3316C11.1042 2.0816 11.0793 1.81597 11.2906 1.62457C11.502 1.43316 11.7838 1.47222 12.0365 1.72222C13.0684 2.74175 13.6982 3.94488 13.9179 5.33941C13.9593 5.60113 13.9717 5.86285 14.0007 6.12457C13.9883 6.12847 13.9842 6.12847 13.98 6.12847Z" fill="white"/>..<path d="M7.1786 0C7.39409 0.0859375 7.63029 0.148438 7.82505 0.269531C8.19386 0.503906 8.37205 0.859375 8.38863 1.28125C8.39691 1.5 8.38863 1.71875 8.38863 1.94141C8.59582 2.01953 8.79887 2.08203 8.99364 2.17188C10.7879 3.01563 11.7369 4.38281 11.8074 6.27734C11.8322 6.92969 11.7991 7.58594 11.8405 8.23828C11.9275 9.54297 12.4041 10.7187 13.2163 11.7734C13.3986 12.0078 13.6058 12.2305 13

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_gray.01873dbe.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2232
                                                                                                                                                                                    Entropy (8bit):3.9969278840420657
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:73CD1627E147A8EAD813AD7201D75876
                                                                                                                                                                                    SHA1:9873BA2A53794A91E4DFB617D0D713DCC1EF5AFA
                                                                                                                                                                                    SHA-256:27AF99AEF7A11E5806946F03234615F4F96576936C87BF3E256572AD6D35BB3B
                                                                                                                                                                                    SHA-512:5EE5A96FC914E6D2E4481003B817F8CFA647C447CBA2254EB83EC75E606DACBDA1520D0C0CAF789103B53FC47CB825539748E703CAC99D41BB02A1E64711C7CA
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_screenshot_white.0e82acc2.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2228
                                                                                                                                                                                    Entropy (8bit):4.011244246624798
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:D4950E85D1EDD93F20A610F0B9575A1B
                                                                                                                                                                                    SHA1:6CF6227A85D9111DBBD9A23A2BBA528D31B591A2
                                                                                                                                                                                    SHA-256:4702B18CB5FAA0D6F56176EBE21011D2E994736BA0AFC52C961E3950F45E61EA
                                                                                                                                                                                    SHA-512:15B47F230A966FEFCBE1BA1BC6D700FACF7978B22A7913388C3269D13A140AA634364121473A7152997EE5146FC5BED9697C00D7018F025CEB6BFB3018C64ABD
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="12" height="14" viewBox="0 0 12 14" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M7.09854 10.2731C7.43835 9.88812 7.85096 9.62347 8.33639 9.50318C9.59851 9.19042 10.8849 9.98435 11.1519 11.2595C11.4189 12.5105 10.5451 13.7615 9.25871 13.954C7.94805 14.1705 6.73447 13.2323 6.61311 11.9331C6.58884 11.7166 6.51602 11.476 6.44321 11.2595C6.17622 10.4415 5.90923 9.62347 5.66652 8.80548C5.64225 8.75736 5.64225 8.70924 5.61798 8.63707C5.59371 8.70924 5.56943 8.7333 5.54516 8.78142C5.22963 9.74376 4.9141 10.7302 4.62284 11.6925C4.5743 11.8369 4.5743 11.9812 4.55003 12.1496C4.30731 13.3285 3.19082 14.1465 2.02578 13.9781C0.763661 13.8097 -0.110117 12.727 0.0112413 11.5C0.108328 10.5618 0.642303 9.88812 1.54035 9.57535C2.4384 9.26259 3.23936 9.47912 3.91897 10.1287C3.96751 10.1768 4.01605 10.2249 4.0646 10.2731C4.08887 10.2249 4.11314 10.1768 4.11314 10.1287C5.15682 6.90485 6.17622 3.65694 7.2199 0.433091C7.29272 0.240623 7.3898 0.0722124 7.60825 0.0240953C7.97232 -0.048

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_search_gray.ebbaf632.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):702
                                                                                                                                                                                    Entropy (8bit):4.39074490019929
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:86893B121171A45F3494D301D57E80F1
                                                                                                                                                                                    SHA1:739B6A99982CE3F6BF792876E72A8413D1583072
                                                                                                                                                                                    SHA-256:4D8B0003A1DA38931E9BA26483D517CD59E62EA14759FC36F14B0F1EC558C6B8
                                                                                                                                                                                    SHA-512:CABD9B44F635F3A1C9C8054004DE318FC3F875F6FD81DB722CD49FD29912E0720B656DD1BA81A5FF8B63C728A81A9A393618E0D18B07227F2AC937A954D9FEB0
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="#827A7A"/>..</svg>..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_search_white.0c376446.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):700
                                                                                                                                                                                    Entropy (8bit):4.387297248681374
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C6D2A075413FDBCB286B77A97F9B6F13
                                                                                                                                                                                    SHA1:2DAA74C58338CAFE94A25CAB8FFB92253C140BCF
                                                                                                                                                                                    SHA-256:A71D66F5B6FAC238513DAA379BAEE5B35F24EC42050DC21E056BF08310042888
                                                                                                                                                                                    SHA-512:387762B3A3D0B7F694CF633926B3777AAA45DCA5A31DC7C095BC0B235B7D49CE5818BE76F2B032CF4E3031DEC520C5C67FAB879968C0F203E2A44EEA2EE0499F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="12" height="12" viewBox="0 0 12 12" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M0.146939 11.1478L3.03184 8.26286C2.31673 7.39102 1.88571 6.27429 1.88571 5.05714C1.88571 2.26531 4.15102 0 6.94286 0C9.73714 0 12 2.26531 12 5.05714C12 7.84898 9.73714 10.1143 6.94286 10.1143C5.72571 10.1143 4.61143 9.68571 3.73959 8.97061L0.854693 11.8531C0.658775 12.049 0.342857 12.049 0.146939 11.8531C-0.0489798 11.6596 -0.0489798 11.3412 0.146939 11.1478ZM6.94286 9.10775C9.17878 9.10775 10.9959 7.29061 10.9959 5.05714C10.9959 2.82367 9.17878 1.00408 6.94286 1.00408C4.70939 1.00408 2.8898 2.82367 2.8898 5.05714C2.8898 7.29061 4.70939 9.10775 6.94286 9.10775Z" fill="white"/>..</svg>..

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_support_gray.a272cc7a.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3466
                                                                                                                                                                                    Entropy (8bit):3.9394896115708424
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:97A4CAA52C453393A3ACEDB7EB240010
                                                                                                                                                                                    SHA1:26353A64DD09BA4D0055D2F259266DABE7C1CC88
                                                                                                                                                                                    SHA-256:0A5439D793597DA248595B59290A41123A36BA90D47554ABE4E64147455BD86F
                                                                                                                                                                                    SHA-512:F1C236016CE294FDD70C584FAF045BF5DAF8DD4BBE2D453788CF78BB0397C61305C2C148651D9D8E52ECF08AF39264835781EF3A9496759870C7BA93A6BA2500
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20209 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_support_white.66ecfc42.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3460
                                                                                                                                                                                    Entropy (8bit):3.951932320279216
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:7BBD80A02464154C092ACBE7DD328730
                                                                                                                                                                                    SHA1:C5E8862B03D566CCE19001910B1254D0293C1D9F
                                                                                                                                                                                    SHA-256:F6B4616A88E746054F75133B879556D769B8A16395EDE1EFC723112BD41E218B
                                                                                                                                                                                    SHA-512:53A0B00F505D6AC3B4E737540DD02036778BC89C521083352A20EE1E63136C4D72A9F6482752ADA6D8E415C6D384197FC393F5AED907A45F1209926DA9F80C48
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="21" height="21" viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M9.89765 0C10.3083 0 10.719 0 11.1297 0C11.1845 0.0136988 11.2392 0.0273993 11.294 0.0273993C12.7588 0.123291 14.1551 0.520555 15.442 1.23289C18.399 2.86305 20.206 5.34254 20.8357 8.67136C20.9179 9.06862 20.9452 9.47958 21 9.87685C21 10.2878 21 10.6988 21 11.1097C20.9863 11.1645 20.9726 11.233 20.9589 11.2878C20.8631 12.7536 20.4661 14.1372 19.7679 15.4249C18.1389 18.3838 15.661 20.1921 12.3344 20.8222C11.9374 20.9044 11.5267 20.9318 11.116 20.9866C10.6917 20.9866 10.2673 20.9866 9.84289 20.9866C9.59648 20.9592 9.35007 20.9318 9.08996 20.8907C7.78944 20.6989 6.57106 20.3154 5.42112 19.6852C5.33898 19.6441 5.20208 19.6304 5.10626 19.6578C4.59974 19.8085 4.10691 19.9729 3.60039 20.1373C2.72425 20.4249 1.8618 20.7126 0.985658 20.9866C0.87614 20.9866 0.766624 20.9866 0.657106 20.9866C0.328553 20.877 0.109518 20.6578 0 20.329C0 20.2195 0 20.1099 0 20.0003C0.0136897 19.9866 0.027379 19.9

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_trash_gray.4f9b6bc3.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4403
                                                                                                                                                                                    Entropy (8bit):3.8960426134967934
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:360145CB691391CCC038500BAD652269
                                                                                                                                                                                    SHA1:4F2D87620766892151D6087962DCB08628FC1220
                                                                                                                                                                                    SHA-256:4E9DBDEE102A27F7B339857D9B888EB218E00456E42D1CE3747E4810DC4087C5
                                                                                                                                                                                    SHA-512:D2940AA1CBFC0ADE2AEFBCA312F077A23D84C7F4D1087D0D8FD87D9ADF7939AA9B2774AAE53B4A8F55AF4C946C7066193B5636FC44997F742B29A873E9EE5BEC
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_trash_white.1601c18d.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4395
                                                                                                                                                                                    Entropy (8bit):3.9130769273478307
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:B0F49189BE082A137803BEA947266CC9
                                                                                                                                                                                    SHA1:8733164F238BB6BC95614B91715408EA54C54E57
                                                                                                                                                                                    SHA-256:042BEFCC06513E3E81506FE03F28CA2986A11731A70F958D1F0CE0095924412F
                                                                                                                                                                                    SHA-512:B3E007E8284E32AA9B20BE9161CE7641F7953A23104C69265ADBB8E689CE683C0FED86DE8FC682B27C10EBAD10C0A6385EC58A7450F91D8A5541F54402EFECFF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="13" height="15" viewBox="0 0 13 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M4.62038 0C5.87329 0 7.12258 0 8.37549 0C8.39354 0.00732064 8.41159 0.0183016 8.42965 0.0219619C9.02541 0.124451 9.44425 0.560029 9.51285 1.16764C9.53451 1.35798 9.51646 1.55564 9.51646 1.76061C9.59951 1.76061 9.65006 1.76061 9.70422 1.76061C10.3577 1.76061 11.0149 1.75695 11.6684 1.76061C12.3111 1.76428 12.8202 2.17057 12.9647 2.78184C13.1019 3.34919 12.8311 3.97511 12.3003 4.23499C12.127 4.31918 12.08 4.42167 12.08 4.58638C12.08 4.59736 12.08 4.60469 12.0764 4.61567C11.9573 6.08712 11.8381 7.56223 11.719 9.03368C11.5962 10.5564 11.4698 12.0754 11.3471 13.5981C11.3182 13.9824 11.2207 14.3338 10.9391 14.6157C10.7296 14.8243 10.4697 14.9305 10.1917 15C7.72557 15 5.26308 15 2.79699 15C2.78977 14.9927 2.78255 14.9854 2.77533 14.9854C2.18318 14.8975 1.70657 14.396 1.65963 13.7299C1.59102 12.7928 1.50798 11.8521 1.43215 10.9151C1.33828 9.79136 1.24801 8.6713 1.15413 7.54758C1.07109 6.51

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_gray.a7446394.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1858
                                                                                                                                                                                    Entropy (8bit):4.054255384536267
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:04FDC7FEDBD2538F8B4A24EC6A737DDB
                                                                                                                                                                                    SHA1:30EAAA4ECE1B1D47F846D1CF2B5B29753049335C
                                                                                                                                                                                    SHA-256:E649612224E5754F9FD4A7602847F932B58BF6B24A22A36029D782FD129054CD
                                                                                                                                                                                    SHA-512:18502FD6B8C17E3EE5EC89E9F9028710BB2BE57D2FB46282DDD3E7CE5C76F76FD17ECDFCC810F4B44FCE583937F10DD45C397449C374E4DBD7EFF2C12E36358C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_turnoff_white.333d83c8.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):1854
                                                                                                                                                                                    Entropy (8bit):4.069519451091226
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:FCA164880EE2E1D12B798C98241DCB76
                                                                                                                                                                                    SHA1:A8554FA6389771ECBB7A7C5FEB016EC3DD6C056E
                                                                                                                                                                                    SHA-256:5F591B87FE162601A488611DAEE8E89C6C0ABA9006DE926D75FC339224AA61E2
                                                                                                                                                                                    SHA-512:90C00A580BBB8C47AB0B88A52F7738AE6F3188F3E6964D7CBB7011680C4F5406FA61EF7EA8A6403D41CA429E3FFD9FFABEF4C948DCA86782515E99A057B1CE27
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="19" height="21" viewBox="0 0 19 21" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M8.896 21C8.53124 20.9487 8.16142 20.9077 7.80173 20.8359C5.14713 20.3231 3.06499 18.9233 1.56544 16.6568C0.521838 15.0826 -0.00502985 13.334 3.61876e-05 11.4418C0.0101683 8.62669 1.02844 6.24228 3.05486 4.30398C3.81983 3.57584 4.69119 3.00665 5.6436 2.57592C6.08435 2.37594 6.54536 2.50926 6.77839 2.89897C7.00636 3.27843 6.92024 3.77069 6.57069 4.03734C6.47443 4.10912 6.36298 4.16553 6.25659 4.21681C4.39229 5.10904 3.05992 6.51918 2.28482 8.45235C1.75289 9.78044 1.6009 11.1547 1.81874 12.5751C2.07711 14.2467 2.79142 15.6928 3.96168 16.8978C5.00021 17.9695 6.25153 18.6925 7.70041 19.0309C9.72683 19.5078 11.6469 19.2207 13.4352 18.1592C15.1424 17.1491 16.3127 15.6723 16.9054 13.7647C17.5893 11.57 17.3613 9.44201 16.2316 7.43705C15.416 5.98589 14.2407 4.91931 12.7411 4.21681C12.4777 4.09374 12.2446 3.93478 12.1433 3.6425C12.0268 3.31432 12.118 2.93999 12.3764 2.70411C12.6651 2.44773 1

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_unpin_gray.712c1820.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2922
                                                                                                                                                                                    Entropy (8bit):3.8955256034331684
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:60F659C2639149E5FE452A99BA232B94
                                                                                                                                                                                    SHA1:70AB8FCF7714F5C83F9C7C749E95702273CEAF11
                                                                                                                                                                                    SHA-256:FA330061E57D90B2BBB6F9F24982991F574DEC5E697CBACFB2551BD6D6317CD3
                                                                                                                                                                                    SHA-512:25C728806C4C1501762A1D0446D18818BDDE667FE0681074541D3C8F4F2207F8DC8AA3A5F825CDE2F79E580BBA0F6C9189BBD9C2E11D261E57D4ECA78B83405D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_unpin_white.6b8ad10f.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2920
                                                                                                                                                                                    Entropy (8bit):3.895777405127468
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:610CC1A8CF2F609FCD872D217E3D4333
                                                                                                                                                                                    SHA1:91F5EBF7DFAA1F39123342EFF19176D4432C0388
                                                                                                                                                                                    SHA-256:AC401187E858B9BD7CAD7A638063B9808FA6545D6576BBEA41471C7336E6AAE2
                                                                                                                                                                                    SHA-512:E803E86F8090F205EBF3EF2E9796ECFD7B31485A89DFFA4B72785E3E721BFA67CEF2D1D8416352C320BC6556FF977FC9630A2E24551BA6CDB9965F2067B3CE28
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="15" height="15" viewBox="0 0 15 15" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M14.7852 5.44353C13.0198 3.71096 11.2747 1.96502 9.5161 0.225768C9.21289 -0.0752561 8.88947 -0.0752561 8.58626 0.225768C7.95964 0.841196 7.33975 1.45662 6.71986 2.07874C6.41665 2.37977 6.41665 2.69417 6.7266 3.00188C6.84788 3.12898 6.98264 3.2427 7.10392 3.36311C7.07697 3.40325 7.07023 3.42332 7.05676 3.4367C6.49077 3.99861 5.93152 4.56052 5.3588 5.10905C5.31163 5.15588 5.19709 5.17595 5.12971 5.16257C4.27399 5.00871 3.41153 4.92844 2.54234 5.04216C1.8416 5.12912 1.18802 5.34987 0.648983 5.82482C0.271659 6.16598 0.264921 6.48039 0.622032 6.83493C1.69336 7.89855 2.77143 8.96886 3.84276 10.0325C3.89667 10.086 3.94383 10.1395 4.02469 10.2198C3.88993 10.3402 3.76191 10.4472 3.64736 10.5609C2.50865 11.6915 1.3632 12.822 0.224493 13.9592C-0.0113341 14.1933 -0.0584993 14.4408 0.0695214 14.6883C0.197542 14.9291 0.453583 15.0562 0.743314 14.976C0.878073 14.9425 1.00609 14.8556 1.10716 14.75

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_weather_gray.6eb05cae.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3445
                                                                                                                                                                                    Entropy (8bit):3.979453075901205
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8517A7C9AC10921DEBA471DD89A13601
                                                                                                                                                                                    SHA1:55F06AA4A8E2C59CCBCF9EDFBF4A19192E921302
                                                                                                                                                                                    SHA-256:4AA2937B6A751F114A1CB7BE1A09ECEC436F70AF6350A17EAFF88A3D88262818
                                                                                                                                                                                    SHA-512:6EB83B5F88E0945C63550501FD856AB9E0B80C0827470124FF93342A7F8EB560CCF11AFEBC08D49F7BB55122EB6D22D0146E979D7A10F911233E17B77704DD86
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="27" height="23" viewBox="0 0 27 23" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26.576 17.9499C26.4889 18.2549 26.4453 18.5599 26.3582 18.8649C25.7918 20.9561 24.0056 22.5245 21.8708 22.7859C21.5223 22.8294 21.1737 22.8294 20.8252 22.8294C17.2527 22.8294 13.6367 22.8294 10.0642 22.8294C7.84227 22.8294 6.09959 21.3917 5.66392 19.257C5.44609 18.2549 5.62036 17.2529 6.14316 16.338C6.18673 16.2508 6.2303 16.2073 6.27387 16.1201C6.01247 15.9023 5.70749 15.6845 5.44609 15.4666C3.57271 13.6804 2.96277 11.502 3.70341 9.0623C4.44405 6.62255 6.18672 5.18485 8.7136 4.74918C11.3712 4.31351 13.9416 5.70765 15.1615 8.10383C15.2486 8.27809 15.3358 8.32166 15.51 8.36523C17.8191 8.5395 19.5182 9.62867 20.5202 11.6763C20.6509 11.8941 20.7381 11.9813 20.9995 11.9813C23.8313 11.9377 26.0968 13.9418 26.4889 16.7301C26.4889 16.7736 26.5325 16.8608 26.5325 16.9043C26.576 17.2529 26.576 17.6014 26.576 17.9499ZM15.5972 21.3046C16.5121 21.3046 17.4706 21.3046 18.3855 21.3046C19.3439 2

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\icon_weather_white.c0043930.svg

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3425
                                                                                                                                                                                    Entropy (8bit):4.01234712901125
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:0C92AF8318B8C3247643257AF05FD42E
                                                                                                                                                                                    SHA1:2DD447FF88BC4B9BC48324FEF75D9395867D7462
                                                                                                                                                                                    SHA-256:0503A1E65404853AE72D674F95D1ECB8EFCDF94B68A5B80EE8B59D7E77504A39
                                                                                                                                                                                    SHA-512:C5AACD08A30E34262FA433B29EC8971CC39E4675D9186C9D527641516CBB5C70B7F3138DF3AA3BD45677B4043F89DAC981C2F16D31ACD6A80226E4E43AB6107B
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="26" height="22" viewBox="0 0 26 22" fill="none" xmlns="http://www.w3.org/2000/svg">..<path d="M26 17.2979C25.9147 17.5917 25.8721 17.8856 25.7869 18.1795C25.2328 20.1948 23.4853 21.7063 21.3968 21.9582C21.0558 22.0002 20.7149 22.0002 20.3739 22.0002C16.8789 22.0002 13.3413 22.0002 9.84631 22.0002C7.6726 22.0002 5.96772 20.6147 5.5415 18.5574C5.32839 17.5917 5.49888 16.6261 6.01034 15.7444C6.05297 15.6604 6.0956 15.6185 6.13822 15.5345C5.88249 15.3246 5.58412 15.1146 5.32839 14.9047C3.49565 13.1833 2.89895 11.0841 3.62352 8.7329C4.34809 6.38173 6.05296 4.99623 8.52503 4.57638C11.125 4.15653 13.6397 5.50005 14.8331 7.80923C14.9183 7.97717 15.0035 8.01915 15.174 8.06114C17.433 8.22908 19.0952 9.2787 20.0755 11.252C20.2034 11.4619 20.2887 11.5459 20.5444 11.5459C23.3148 11.5039 25.5311 13.4352 25.9147 16.1223C25.9147 16.1643 25.9574 16.2482 25.9574 16.2902C26 16.6261 26 16.962 26 17.2979ZM15.2593 20.5307C16.1543 20.5307 17.092 20.5307 17.9871 20.5307C18.9248 20.5307 19.8198 20.

                                                                                                                                                                                    C:\Users\user\PCAppStore\ui\static\media\in_background_auto_update_img.dd2961b8.png

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    File Type:PNG image data, 490 x 140, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):11957
                                                                                                                                                                                    Entropy (8bit):7.943985153985361
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:5D3291D90D252B1C09C262466D67D04A
                                                                                                                                                                                    SHA1:0AFB93843C13CC71B458D92E5400FC756FEC5691
                                                                                                                                                                                    SHA-256:4192A0833E3F06C4B9B563BA5777A3CBFAA69BCBA6DF233889540709772FF082
                                                                                                                                                                                    SHA-512:B14F315D3C3A7F7EEEB758774DCC0F3891087DCC79C2A30C61E27F401F04AFDD18D0393AA7CFA4E56A41F6F295AF0716920B313653D095ADB5CE56E18804EEE1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.PNG........IHDR.....................pHYs.................sRGB.........gAMA......a....JIDATx..}p..}.b......l.`...cp.p..$....M...$...6.I.o...i...N.f...L.G.M..8.f...0..,$1..........3.X....=.s........+..~f4..=.y?.w~..9.i.c.Q'..B.<2..'..B.."A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..1..B.!D....B.!r....B..c$...B..#A-..B...j!..".HP.!..9F.Z.!..17...2........&wS.m..^..r..x......kC/9!..b..r..m... ..=.GA@g.j..7...I`.!..I..RP..y.k.....^....kCn.....wB.!..`...E.q9.}......q-7..z._Z|.......T0o.....7...~......+.n....Y.q.+.5....IW.O..~o.....Y...].Y....v.....~w..{.../..?..g..y...?...x..g...'....zA...o...7o..........R......W)...k........._..[{....|..?..?.Y..?......O.`.{<..j..dtt.......Q-...c_..S.Zz<G.R?.so.....H...}.I..o}....cuiy......_y.}...s---..O~5..g.wB.Q.......k..z@X.....t..._.qn.]w.A..D..<......@.,.=....>.v.u.{.....s...4..ou.>......7....o.-.X.Tz.....

                                                                                                                                                                                    Chrome Cache Entry: 309

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4882), with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4882
                                                                                                                                                                                    Entropy (8bit):5.842218004067943
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:2D49126CEBB2E3658C79B6F12BF854F5
                                                                                                                                                                                    SHA1:1BE799AEFC02BF199B1BE96F385153EE95D9E163
                                                                                                                                                                                    SHA-256:3FF84D25B3F0641A824524FFC643802A31C53A24797543F9598F2F68DA4031AF
                                                                                                                                                                                    SHA-512:D08E405924EBD1F5A19995CBB9AA7027AABA10C96FFB33ADCED0E564ACCFED186D2D4C32A3B3DD56A61AEF9614D711864DEC35E9CE914495016BFD6F6FE90251
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 310

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):438963
                                                                                                                                                                                    Entropy (8bit):5.626514452000461
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:122078BAF38F607319F35A038F144893
                                                                                                                                                                                    SHA1:F0561E0A498FF605298B4E1023877D888A9ED824
                                                                                                                                                                                    SHA-256:C1548093BD8975329E311060DFADAAE5910FCE999227AF0B64A29A0FC7B70AE2
                                                                                                                                                                                    SHA-512:F17654BD947B56ABBF7C67B8C852EF61BACA55A6381A59300693286BE55F20399F9311B77B2842160EF92EE1E4A6DE4FC504C1FB2C25DA43044B9A81F73692F1
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                    Chrome Cache Entry: 311

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4865), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):4865
                                                                                                                                                                                    Entropy (8bit):5.837812562738496
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:FE409BD8A59688C3A92A794DE17183E4
                                                                                                                                                                                    SHA1:ADB972158D25500BD3D71AAC6B7DDC34CFE07694
                                                                                                                                                                                    SHA-256:2B4CEA301D591CDA2597E72F8B45951D54D245EC6E66B1DD924B6F0692CFC16C
                                                                                                                                                                                    SHA-512:C986D89C8B5E88897649197B992B7252F00C76F5831EF998B0D15CA1A7A53AA386A6D748AF8522D79C777B941DAA153D1E1363C7154466B5FD2513A15B9F1C49
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436136&cv=11&fst=1730372436136&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 312

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (22120), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):22120
                                                                                                                                                                                    Entropy (8bit):5.548923264962435
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:73D60E1CA5B51547D1DA660502E7CCCA
                                                                                                                                                                                    SHA1:61285697B98614CECF36823D3BB51D0190E65EBD
                                                                                                                                                                                    SHA-256:ED12A72FB713CA037417C75CF7CDB61C8D7F70EEE8CC4C7753AD725FABF85A22
                                                                                                                                                                                    SHA-512:3EB0CA2B250A32AEACB67CD769B6B017C2617E2137570C99207F4A270A4E2BB62608792DA5132E258F3AA672C20DA427C407BE3E4DBAC93E9F2BD2F68929DA8E
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://td.doubleclick.net/td/rul/858128210?random=1730372436188&cv=11&fst=1730372436188&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view
                                                                                                                                                                                    Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s2146701656.1730372436","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s2146701656.1730372436\u0026ig_key=1sNHMyMTQ2NzAxNjU2LjE3MzAzNzI0MzY!2sZ3J9Vw!3sAAptDV5D2-KM","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1s95vUuQ!2sZ3J9Vw!3sAAptDV5D2-KM"],"userBiddingSignals":[["7904705661","7904283812","7896384790","475816165","7900466892","596093288"],null,1730372439099648],"ads":[{"renderUrl":"https://tdsf.doublecli

                                                                                                                                                                                    Chrome Cache Entry: 313

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4863), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):4863
                                                                                                                                                                                    Entropy (8bit):5.840587458448929
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:04000487B2787960A0DEBD0FC4F701C6
                                                                                                                                                                                    SHA1:9EE8F83E5860E15704091248475606E110E35DB4
                                                                                                                                                                                    SHA-256:700960A735E52B2DEE023DF3B84E29B5C22BBD3E0EFF31DD6A7DD801BCDF2529
                                                                                                                                                                                    SHA-512:735219E2CAB4E83641AD59ECF0F2F106502F1E79FBF183FA2390E99BB10481B33EB8D19735FE8F543861567F37A7755B5B92366FA9C4780860444B7D555CB100
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436188&cv=11&fst=1730372436188&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dpage_view&rfmt=3&fmt=4
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 314

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):365381
                                                                                                                                                                                    Entropy (8bit):5.59807404014943
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:6FAF29F8C9046A5D606A9A51D1B9D37D
                                                                                                                                                                                    SHA1:08C8B0C6484206C1C3693069F8750483778E7B63
                                                                                                                                                                                    SHA-256:7FD8749DCD37F44FF107360B1504941A94EB8305942AF2CBB72EC850FFE3F900
                                                                                                                                                                                    SHA-512:CDDFB51D716D0958B8928E4BD0DEA805E512B27487492E1A4AE51D880B5DE1A3CE3F36007A0A240F7D5320FFEA8819413A15A0D8946C59B61017F2D1A64A01AF
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                    Chrome Cache Entry: 315

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):3592
                                                                                                                                                                                    Entropy (8bit):4.71780114350715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                    SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                    SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                    SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_cursor_icon.svg
                                                                                                                                                                                    Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                    Chrome Cache Entry: 316

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (22120), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):22120
                                                                                                                                                                                    Entropy (8bit):5.548810357392377
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:DB08627CB982F2AB8EB7451316FA5639
                                                                                                                                                                                    SHA1:5E0110EB6ADF14C22014CFE371EC8042D7551552
                                                                                                                                                                                    SHA-256:FABB5778A796B56F736FE985B3AF3C4669D4CC5D524173FBB9A40574705D047D
                                                                                                                                                                                    SHA-512:F168C3844DD6A773B1AB2D86F967CCB4AFDBED765EB2EC92F898A50AF66D0E7F00B784A39CE97BD20F7ED2B5A6696F7FED3AAF4105800EABEC292BD90E8C89B9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://td.doubleclick.net/td/rul/858128210?random=1730372436136&cv=11&fst=1730372436136&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dgtag.config
                                                                                                                                                                                    Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":5184000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s2146701656.1730372436","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s2146701656.1730372436\u0026ig_key=1sNHMyMTQ2NzAxNjU2LjE3MzAzNzI0MzY!2sZ3J9Vw!3sAAptDV5D2-KM","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1s95vUuQ!2sZ3J9Vw!3sAAptDV5D2-KM"],"userBiddingSignals":[["7900466892","7896384790","475816165","7904705661","596093288","7904283812"],null,1730372439082669],"ads":[{"renderUrl":"https://tdsf.doublecli

                                                                                                                                                                                    Chrome Cache Entry: 317

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4977), with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4977
                                                                                                                                                                                    Entropy (8bit):5.860086707960823
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:E9F2A851EF9C525C4456422082B0868F
                                                                                                                                                                                    SHA1:9650A61CB10A44F04F653FF36809287156289805
                                                                                                                                                                                    SHA-256:E571852BB5C0E706767C0A4D6196A40FA1FA9CA01FD384530952732C6FBAB67D
                                                                                                                                                                                    SHA-512:88C9E5AA1545939285021A4F9A23A8688C6AC23D5B42456AC41CCA4E5E2660082EB561B559142A6526F80174A419635609B1597C1E71CE4348593986CD176A2D
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 318

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):290212
                                                                                                                                                                                    Entropy (8bit):5.559734580271949
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:3D100B93A563F6C546FBFBF248D04DEE
                                                                                                                                                                                    SHA1:D745C9797E10D4D0D2E2A604955E7246F506C61D
                                                                                                                                                                                    SHA-256:1E9DA077D688B5AADF25835915F1CEDB32DBA819AE81064F0C6DBF622016DBA9
                                                                                                                                                                                    SHA-512:0F9F77299D37359B3D2E7A78A48E268461F2CA80969901F7B805E0FA30A124554D3745F8F593EBABE90EEBE2510450B03D13C52A38F1ECC3BDBFD19B59211485
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                    Chrome Cache Entry: 319

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (3969)
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):290212
                                                                                                                                                                                    Entropy (8bit):5.559734580271949
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:3D100B93A563F6C546FBFBF248D04DEE
                                                                                                                                                                                    SHA1:D745C9797E10D4D0D2E2A604955E7246F506C61D
                                                                                                                                                                                    SHA-256:1E9DA077D688B5AADF25835915F1CEDB32DBA819AE81064F0C6DBF622016DBA9
                                                                                                                                                                                    SHA-512:0F9F77299D37359B3D2E7A78A48E268461F2CA80969901F7B805E0FA30A124554D3745F8F593EBABE90EEBE2510450B03D13C52A38F1ECC3BDBFD19B59211485
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://www.googletagmanager.com/gtag/js?id=AW-858128210
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"2",. . "macros":[{"function":"__e"}],. "tags":[{"function":"__ogt_ads_datatos","priority":16,"vtp_instanceDestinationId":"AW-858128210","tag_id":16},{"function":"__ogt_cps","priority":6,"vtp_cpsMode":"ALL","tag_id":8},{"function":"__ogt_1p_data_v2","priority":6,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionType":"CSS_SELECTOR","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneType":"CSS_SELECTOR","vtp_phoneValue":"","vtp_streetType":"CSS_SELECTOR","vtp_autoPhoneEnabled":false,"vtp_postalCodeType":"CSS_SELECTOR","vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_

                                                                                                                                                                                    Chrome Cache Entry: 320

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):3592
                                                                                                                                                                                    Entropy (8bit):4.71780114350715
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:0FFC071BC5AF33D2BE224CF147670471
                                                                                                                                                                                    SHA1:5A7FC912A47D0531B2C95BFCB6BEAAA2248E0779
                                                                                                                                                                                    SHA-256:1923EFD4718E21B882410106B6FEF7FA35C3EB2EC3C2338CD8DFF07108F25C1F
                                                                                                                                                                                    SHA-512:205AF4B98312AB012BE7D7C25AC0A6D91D11C77DC3E29A9D6CC80F96A97577826079469AF16F88FE214CF0A17C70261C4AAA671FBB19EF214B91776BC3683353
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="107" height="109" viewBox="0 0 107 109" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_286)"><path d="M78.856 41.614c.048-.048.096-.048.096-.096.048-.048.048-.096.048-.143v-.192c0-.096-.048-.144-.096-.24a.84.84 0 00-.191-.239c-.048-.096-.144-.143-.24-.191-.096-.048-.191-.144-.287-.192L31.16 17.144c-.096-.048-.144-.048-.24-.096S30.777 17 30.68 17h-.574c-.096 0-.144.048-.191.096-.048.048-.096.048-.144.096-.048.047-.048.095-.096.143L28 23.8v.191l7.853 43.29c0 .144.048.24.144.336.048.096.144.191.24.287.095.096.191.192.335.24.096.047.24.143.383.143.048 0 .048 0 .096.048h.622s.048 0 .048-.048c0 0 .048 0 .048-.048h.048s.048 0 .048-.047h.048l.048-.048.047-.048 10.153-14.27L63.1 70.537l.048.048s.048 0 .048.048l.048.048s.048.048.096.048h.096c.047 0 .047.047.095.047s.048.048.096.048h.863c.048 0 .048 0 .096-.047.048 0 .048-.048.096-.048l8.476-5.986 4.214-5.603c.048-.048.048-.096.096-.144 0-.048.047-.096.047-.144v-.191c0-.048-.047-.144-.047-.192a.363.363 0

                                                                                                                                                                                    Chrome Cache Entry: 321

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):365381
                                                                                                                                                                                    Entropy (8bit):5.598068597200656
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:E8A86B539083CD70AA36C3105CE5320D
                                                                                                                                                                                    SHA1:88D0D5300F5DAF25BA77A0B9EAEF1CFF5E34F7DE
                                                                                                                                                                                    SHA-256:0CF836BD2877E04AA725581AF3A2EF12C9975970B74870C6ED81CA947C26487D
                                                                                                                                                                                    SHA-512:0CDDC310AB239F9B5F54CE7DC201BC2DA5C70120D382A6437A2F0001CF9586F7F2045D89C7645CC4F8E7B37FAFD8339CEC7A3112D839250B07F1C51FA410A80C
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://www.googletagmanager.com/gtag/js?id=G-VFQWFX3X1C&l=dataLayer&cx=c
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                    Chrome Cache Entry: 322

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (22134), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):22134
                                                                                                                                                                                    Entropy (8bit):5.5480698024722015
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:7671B09EAF0FB0954FC0EC5F5C761DA5
                                                                                                                                                                                    SHA1:A2F76E048FAA53AA2DAC946BBA255AEFC7020E26
                                                                                                                                                                                    SHA-256:F09D34305AF09E52B5A40CD1CEB6E587670367953990E498874078C9857E1AE6
                                                                                                                                                                                    SHA-512:03F52F7E92B74100F016AF72BE6BDEB8A3DFC3FC55954B8E1E47D5F21C670433CA394FB37694AD4C6216595AC4796973949E85B1088CCD156EC692932F845385
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://td.doubleclick.net/td/rul/858128210?random=1730372436528&cv=11&fst=1730372436528&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion
                                                                                                                                                                                    Preview:<html><head><meta http-equiv="origin-trial" content="Avh5Ny0XEFCyQ7+oNieXskUrqY8edUzL5/XrwKlGjARQHW4TFRK+jVd5HnDIpY20n5OLHfgU4ku7x48N3uhG/A0AAABxeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiUHJpdmFjeVNhbmRib3hBZHNBUElzIiwiZXhwaXJ5IjoxNjk1MTY3OTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="></head><body><script>var ig_list={"interestGroups":[{"action":0,"expirationTimeInSeconds":31104000,"interestGroupAttributes":{"owner":"https://td.doubleclick.net","name":"4s2146701656.1730372436","biddingLogicUrl":"https://td.doubleclick.net/td/bjs","dailyUpdateUrl":"https://td.doubleclick.net/td/update?ig_name=4s2146701656.1730372436\u0026ig_key=1sNHMyMTQ2NzAxNjU2LjE3MzAzNzI0MzY!2saP3_Vw!3sAAptDV5wsY5t","trustedBiddingSignalsUrl":"https://td.doubleclick.net/td/bts","trustedBiddingSignalsKeys":["1s95vUuQ!2saP3_Vw!3sAAptDV5wsY5t"],"userBiddingSignals":[["7904705661","7904283812","475816165","7896384790","8552333481","7900466892","596093288"],null,1730372439101299],"ads":[{"renderUrl":"https://

                                                                                                                                                                                    Chrome Cache Entry: 323

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):48444
                                                                                                                                                                                    Entropy (8bit):7.995593685409469
                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8E433C0592F77BEB6DC527D7B90BE120
                                                                                                                                                                                    SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                                                                                                                                                                                    SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                                                                                                                                                                                    SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
                                                                                                                                                                                    Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                                                                                                                                                                                    Chrome Cache Entry: 324

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):2118
                                                                                                                                                                                    Entropy (8bit):4.907323279161229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                    SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                    SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                    SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                    Chrome Cache Entry: 325

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):2499
                                                                                                                                                                                    Entropy (8bit):5.4636477793325495
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:382991778933FB8F5697DEB2EE26A0ED
                                                                                                                                                                                    SHA1:6CDED0C76F01EA3C3C6DB8128B5CF59063A92C78
                                                                                                                                                                                    SHA-256:0919FF36779EEF85FA50AF4B94FB2D496A765612B7C5EDD31BA69EA1F4136736
                                                                                                                                                                                    SHA-512:FC05BAFD9EB747B7060B8C730E8A467CFD0A0311622B325E5EB74A1083D3A7B8897396CF4FE310E7567EAA1B5A951AB3906F57E57671F2852A18ED1AD0E7E2C9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://fonts.googleapis.com/css2?family=Inter:wght@100..900&display=swap
                                                                                                                                                                                    Preview:/* cyrillic-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2JL7SUc.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa0ZL7SUc.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. font-display: swap;. src: url(https://fonts.gstatic.com/s/inter/v18/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa2ZL7SUc.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Inter';. font-style: normal;. font-weight: 100 900;. f

                                                                                                                                                                                    Chrome Cache Entry: 326

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4881), with no line terminators
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):4881
                                                                                                                                                                                    Entropy (8bit):5.84380898174351
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:8692B0506A81E3E47E73D1B442735C33
                                                                                                                                                                                    SHA1:0BEE97AD33CD40B153A2DB70F0D91755E80EC5AC
                                                                                                                                                                                    SHA-256:E28DAA67ECBC688BCA7E58F988CA9863D5521669B4A26289A03650C3C63391C1
                                                                                                                                                                                    SHA-512:A8DF80D15BBC04D0A3E6D68F1E42E4B0E04E1FB4C9E5E01FBB9F15A6564C993F1D9CCCC66F3006620B32B6C1ED7096A66A1E628DF877645687E4BB5E13FB06E9
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 327

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:HTML document, ASCII text, with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                                    Entropy (8bit):2.7773627950641693
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:C83301425B2AD1D496473A5FF3D9ECCA
                                                                                                                                                                                    SHA1:941EFB7368E46B27B937D34B07FC4D41DA01B002
                                                                                                                                                                                    SHA-256:B633A587C652D02386C4F16F8C6F6AAB7352D97F16367C3C40576214372DD628
                                                                                                                                                                                    SHA-512:83BAFE4C888008AFDD1B72C028C7F50DEE651CA9E7D8E1B332E0BF3AA1315884155A1458A304F6E5C5627E714BF5A855A8B8D7DB3F4EB2BB2789FE2F8F6A1D83
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://td.doubleclick.net/td/ga/rul?tid=G-VFQWFX3X1C&gacid=186695171.1730372436&gtm=45je4au0h2v898645365za200zb9103256652&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101533422~101823848~101878899~101878944~101925629&z=784675448
                                                                                                                                                                                    Preview:<html></html>

                                                                                                                                                                                    Chrome Cache Entry: 328

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (815)
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):3501
                                                                                                                                                                                    Entropy (8bit):5.383873370647921
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:147FD3B00C22BA9C939712E9213C24CA
                                                                                                                                                                                    SHA1:3B48369B86FA0574F35379AACD1F42CC9C98A52B
                                                                                                                                                                                    SHA-256:70F5B11C1870CF90201A6D5F770CA318A3FA5827C74A8765EDE22B487F7D4532
                                                                                                                                                                                    SHA-512:E8419A71232EDAC8FD131446777F7D034B3171EFE07B3267479B439E4982650DB65A0D1DDC9F516315D5ED1B01ECFD2F7EB55D75D44AA51EE0AD494D441586D2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                    Preview:<!DOCTYPE html>.<html>.<head>. <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon">.</head>.<body>. <script>.'use strict';class m{constructor(a){this.j=a;this.g={};this.h={};this.i=0;this.id=String(Math.floor(Number.MAX_SAFE_INTEGER*Math.random()))}}function n(a){return a.performance&&a.performance.now()||Date.now()}.var p=function(a,b){class d{constructor(c,g,f){this.failureType=c;this.data=g;this.g=f;this.h=new m(n(f))}s(c,g){const f=c.clientId;if(c.type===0){c.isDead=!0;var e=this.h,h=n(this.g);e.g[f]==null&&(e.g[f]=0,e.h[f]=h,e.i++);e.g[f]++;c.stats={targetId:e.id,clientCount:e.i,totalLifeMs:Math.round(h-e.j),heartbeatCount:e.g[f],clientLifeMs:Math.round(h-e.h[f])}}c.failure={failureType:this.failureType,data:this.data};g(c)}}return new d(5,a,b)};/*.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0.*/.let q=globalThis.trustedTypes,r;function t(){let a=null;if(!q)return a;try{const b=d=>d;a=q.createPolicy("goog#html",{createHTML:b,createScript:b,crea

                                                                                                                                                                                    Chrome Cache Entry: 329

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (14408)
                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                    Size (bytes):365348
                                                                                                                                                                                    Entropy (8bit):5.597948010705335
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:91A1451FDBA9E9D7A3FFA326BC733817
                                                                                                                                                                                    SHA1:F3873375BD2EEEBC2C57516BCFEC0EE6E7EEF548
                                                                                                                                                                                    SHA-256:C94A896896AA9EC990A228CBDE439BA73CE8A8E6EF3387BFF3F0B6B33D826953
                                                                                                                                                                                    SHA-512:E18122556F8A23F7F92FA0A2D24E052DAAE7691DE112A45614F76F2A1D1375F41087B6862D488914051F72648484F971B577BA772CBDE516005C775D8B02AA36
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"3",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":""},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_cross_domain","priority":39,"vtp_rules":["list","pcapp\\.store","pcappstore\\.download"],"tag_id":11},{"function":"__ogt_ga_send","priority":29,"vtp_value":true,"tag_id":13},{"function":"__ogt_referral_exclusion","priority":29,"vtp_includeConditions":["list","veryfast\\.io"],"tag_id":14},{"function":"__ogt_session_timeout","priority":29,"vtp_sessionMinutes":30,"vtp_sessionHours":0,"tag_id":15},{"function":"__ogt_1p_data_v2","priority":29,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_cityType":"CSS_SELECTOR","vtp_manualEmailEnabled":false,"vtp_firstNameType":"CSS_SELECTOR","vtp_countryType":"CSS_SELECTOR","vtp_cityValue":"","vtp_emailType":"CSS_SELECTOR","vtp_regionTy

                                                                                                                                                                                    Chrome Cache Entry: 331

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (723)
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):7076
                                                                                                                                                                                    Entropy (8bit):5.52488676121649
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:88A2E0A522036C0B87E03552E56629AA
                                                                                                                                                                                    SHA1:EC9D1157518E753A84DBDE1333A29B34CF776D63
                                                                                                                                                                                    SHA-256:788AFB96F2DA68E8729EC35F3D5E381FAD3482D37C54C2195C7311440EE4C27E
                                                                                                                                                                                    SHA-512:44B953878BD650FE2BCC8B6904620955C3E396B7DC8F41F85D021A8E0404DA41DB15C5499A03F7D4FE9129BB340AA3F6782942CF5327502FD4569BEBBB17073F
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://www.googletagmanager.com/static/service_worker/4al0/sw.js?origin=https%3A%2F%2Fpcapp.store
                                                                                                                                                                                    Preview:'use strict';var k=function(a){function b(c){return a.next(c)}function e(c){return a.throw(c)}return new Promise(function(c,d){function f(h){h.done?c(h.value):Promise.resolve(h.value).then(b,e).then(f,d)}f(a.next())})};/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var m=this||self;var u,v;a:{for(var x=["CLOSURE_FLAGS"],B=m,C=0;C<x.length;C++)if(B=B[x[C]],B==null){v=null;break a}v=B}var G=v&&v[610401301];u=G!=null?G:!1;var H;const I=m.navigator;H=I?I.userAgentData||null:null;function J(a){return u?H?H.brands.some(({brand:b})=>b&&b.indexOf(a)!=-1):!1:!1}function K(a){var b;a:{const e=m.navigator;if(e){const c=e.userAgent;if(c){b=c;break a}}b=""}return b.indexOf(a)!=-1};function L(){return u?!!H&&H.brands.length>0:!1}function O(){return L()?J("Chromium"):(K("Chrome")||K("CriOS"))&&!(L()?0:K("Edge"))||K("Silk")};!K("Android")||O();O();!K("Safari")||O()||(L()?0:K("Coast"))||(L()?0:K("Opera"))||(L()?0:K("Edge"))||(L()?J("Microsoft Edge"):K("Edg/"))||L()&

                                                                                                                                                                                    Chrome Cache Entry: 332

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:ASCII text, with very long lines (4962), with no line terminators
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):4962
                                                                                                                                                                                    Entropy (8bit):5.855744357800679
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:169B3720A5798B1B7039C26B977F0148
                                                                                                                                                                                    SHA1:E21B82F11BF0627CCD7249BDAD4375A12A0A1570
                                                                                                                                                                                    SHA-256:2855E48B46C0A1C26874426EED5D5F829484B3E50229640DE5B471EDD0184970
                                                                                                                                                                                    SHA-512:4C6A0B18ABB42DFAA1843AD403C0394398E1AF479364F5BC2DD06781EA83360E69E6BDF7F0DF17DE756620F815FDDD74BE185689E99DB6F1437BCCDB7B4F4AD2
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858128210/?random=1730372436528&cv=11&fst=1730372436528&bg=ffffff&guid=ON&async=1&gtm=45be4as0v9103256652za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101533422~101823848~101878899~101878944~101925629&u_w=1280&u_h=1024&url=https%3A%2F%2Fpcapp.store%2F%3Fp%3Dlpd_installing_r2%26guid%3D71434D56-1548-ED3D-AEE6-C75AECD93BF0%26_fcid%3D1730271248380473%26_winver%3D19045%26version%3Dfa.1092c&label=kTaFCIuq0YYZENL-l5kD&hn=www.googleadservices.com&frm=0&tiba=APP%20STORE%3A%20Installing&value=1&currency_code=USD&npa=0&pscdl=noapi&auid=2146701656.1730372436&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B117.0.5938.132%7CNot%253BA%253DBrand%3B8.0.0.0%7CChromium%3B117.0.5938.132&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&fledge=1&data=event%3Dconversion&rfmt=3&fmt=4
                                                                                                                                                                                    Preview:(function(){var s = {};(function(){var h=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,d){if(a==Array.prototype||a==Object.prototype)return a;a[b]=d.value;return a};function k(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var d=a[b];if(d&&d.Math==Math)return d}throw Error("Cannot find global object");} var m=k(this),p=typeof Symbol==="function"&&typeof Symbol("x")==="symbol",t={},v={};function w(a,b,d){if(!d||a!=null){d=v[b];if(d==null)return a[b];d=a[d];return d!==void 0?d:a[b]}} function x(a,b,d){if(b)a:{var c=a.split(".");a=c.length===1;var e=c[0],g;!a&&e in t?g=t:g=m;for(e=0;e<c.length-1;e++){var f=c[e];if(!(f in g))break a;g=g[f]}c=c[c.length-1];d=p&&d==="es6"?g[c]:null;b=b(d);b!=null&&(a?h(t,c,{configurable:!0,writable:!0,value:b}):b!==d&&(v[c]===void 0&&(a=Math.random()*1E9>>>0,v[c]=p?m.Symbol(c):"$jscp$"+a+"$"+c),h(g,v[c],{co

                                                                                                                                                                                    Chrome Cache Entry: 333

                                                                                                                                                                                    Download File
                                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                    Category:downloaded
                                                                                                                                                                                    Size (bytes):2118
                                                                                                                                                                                    Entropy (8bit):4.907323279161229
                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                    SSDEEP:
                                                                                                                                                                                    MD5:1039640CF0666A1621D55C9E9FA81439
                                                                                                                                                                                    SHA1:A7E6A6AB233DAE1776506F2E6C7FD03E46E83EA9
                                                                                                                                                                                    SHA-256:4455C2A26901C4D348E194B06B06908C155E6459CF5987984D03848E30964F0C
                                                                                                                                                                                    SHA-512:F9324B6C58C51DC3F24BD242EADA7E5565B60E12863EC13F28D883028791AEC7EC5E324298FA0427AD1CD45BDD7260FF0295DC171F24DD0AC3F0203FB6CD0706
                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                    URL:https://repository.pcapp.store/pcapp/images/front_img/lp/lpd_installing_r2/img/done_windows_icon.svg
                                                                                                                                                                                    Preview:<svg width="132" height="132" viewBox="0 0 132 132" fill="none" xmlns="http://www.w3.org/2000/svg"><g filter="url(#filter0_d_539_279)"><path d="M16 12.5A4.5 4.5 0 0120.5 8h91a4.5 4.5 0 014.5 4.5v91a4.5 4.5 0 01-4.5 4.5h-91a4.5 4.5 0 01-4.5-4.5v-91z" fill="#fff"/></g><path d="M81.894 54.233H67.64c-.913 0-.913 0-.913-.865V32.733c0-.865 0-.845.85-.966 3.341-.463 6.661-.946 10.002-1.41 3.839-.543 7.657-1.066 11.496-1.59 2.345-.322 4.69-.664 7.014-.986 1.037-.14 1.037-.14 1.037.866v24.6c0 .986 0 .986-1.016.986H81.894zm.021 5.841h14.422c.767 0 .767 0 .767.765v24.963c0 .845 0 .865-.871.745-3.32-.463-6.64-.947-9.94-1.41-2.282-.322-4.586-.624-6.868-.946-2.801-.382-5.603-.785-8.404-1.187-1.204-.161-2.386-.363-3.59-.484-.54-.06-.705-.261-.705-.764.02-4.067.02-8.113.02-12.18v-8.898c0-.463.146-.604.623-.604 4.814.02 9.69 0 14.546 0zm-34.175.001h12.243c.705 0 .705 0 .705.704v19.669c0 .825-.041.825-.892.704-2.47-.342-4.918-.684-7.387-1.026-2.158-.303-4.316-.625-6.454-.927-2.448-.342-4.897-.664-7.345-

                                                                                                                                                                                    Static File Info

                                                                                                                                                                                    General

                                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                    Entropy (8bit):7.6127479141726075
                                                                                                                                                                                    TrID:
                                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                    File name:Setup.exe
                                                                                                                                                                                    File size:190'056 bytes
                                                                                                                                                                                    MD5:c306c6af9bd1955956f52acc1c9327ea
                                                                                                                                                                                    SHA1:3b3ed814ac41a710212cc83d92fde56a38b42b17
                                                                                                                                                                                    SHA256:9c7c1345990163c48c6f4801e26b12390c498395bf280a79ecf6aee816eefb49
                                                                                                                                                                                    SHA512:be0fa745874d582c26c0d2fd70bd56daf8e431f155fdde949b0c3c59a2736297fabbf501c2c6beb4112460d3d4107b100f4c005ad74a929f2cfda5276af503d2
                                                                                                                                                                                    SSDEEP:3072:UbG7N2kDTHUpouL4Ynd86Pzy5n+/mGCK8izuG2okB2h4l591BBgkXmUI:UbE/HUzRe6ry5nmQiiGz4z9TJXrI
                                                                                                                                                                                    TLSH:D504F15056E0C862D8A28B71B5797F7B8AB5DC2192B04F8313107B187E7DE819F0E3A3
                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf.*_9..Pf..Pg.LPf.*_;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

                                                                                                                                                                                    File Icon

                                                                                                                                                                                    Icon Hash:45d44c7192498005

                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                    General

                                                                                                                                                                                    Entrypoint:0x40352d
                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                    Digitally signed:true
                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                    Time Stamp:0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                    OS Version Major:4
                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                    File Version Major:4
                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                    Subsystem Version Major:4
                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                    Import Hash:56a78d55f3f7af51443e58e0ce2fb5f6

                                                                                                                                                                                    Authenticode Signature

                                                                                                                                                                                    Signature Valid:true
                                                                                                                                                                                    Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                    Signature Validation Error:The operation completed successfully
                                                                                                                                                                                    Error Number:0
                                                                                                                                                                                    Not Before, Not After
                                                                                                                                                                                    • 08/05/2024 01:00:00 13/02/2025 23:59:59
                                                                                                                                                                                    Subject Chain
                                                                                                                                                                                    • CN=FAST CORPORATION LTD, O=FAST CORPORATION LTD, L=Ra'anana, C=IL, SERIALNUMBER=515636181, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=IL
                                                                                                                                                                                    Version:3
                                                                                                                                                                                    Thumbprint MD5:04786BD703B906E22AECB2AD38CE4D94
                                                                                                                                                                                    Thumbprint SHA-1:07BE42727905BE32C822A638502C1B8FAAE6540A
                                                                                                                                                                                    Thumbprint SHA-256:FDB017BB88E5D453E22A73810690C72534F58EFB109EA0D4494EC393F2307DBC
                                                                                                                                                                                    Serial:0E5C655E1CBE9A8879372F58A5BC0302

                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                    Instruction
                                                                                                                                                                                    push ebp
                                                                                                                                                                                    mov ebp, esp
                                                                                                                                                                                    sub esp, 000003F4h
                                                                                                                                                                                    push ebx
                                                                                                                                                                                    push esi
                                                                                                                                                                                    push edi
                                                                                                                                                                                    push 00000020h
                                                                                                                                                                                    pop edi
                                                                                                                                                                                    xor ebx, ebx
                                                                                                                                                                                    push 00008001h
                                                                                                                                                                                    mov dword ptr [ebp-14h], ebx
                                                                                                                                                                                    mov dword ptr [ebp-04h], 0040A2E0h
                                                                                                                                                                                    mov dword ptr [ebp-10h], ebx
                                                                                                                                                                                    call dword ptr [004080CCh]
                                                                                                                                                                                    mov esi, dword ptr [004080D0h]
                                                                                                                                                                                    lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                    push eax
                                                                                                                                                                                    mov dword ptr [ebp-0000012Ch], ebx
                                                                                                                                                                                    mov dword ptr [ebp-2Ch], ebx
                                                                                                                                                                                    mov dword ptr [ebp-28h], ebx
                                                                                                                                                                                    mov dword ptr [ebp-00000140h], 0000011Ch
                                                                                                                                                                                    call esi
                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                    jne 00007F9964B2277Ah
                                                                                                                                                                                    lea eax, dword ptr [ebp-00000140h]
                                                                                                                                                                                    mov dword ptr [ebp-00000140h], 00000114h
                                                                                                                                                                                    push eax
                                                                                                                                                                                    call esi
                                                                                                                                                                                    mov ax, word ptr [ebp-0000012Ch]
                                                                                                                                                                                    mov ecx, dword ptr [ebp-00000112h]
                                                                                                                                                                                    sub ax, 00000053h
                                                                                                                                                                                    add ecx, FFFFFFD0h
                                                                                                                                                                                    neg ax
                                                                                                                                                                                    sbb eax, eax
                                                                                                                                                                                    mov byte ptr [ebp-26h], 00000004h
                                                                                                                                                                                    not eax
                                                                                                                                                                                    and eax, ecx
                                                                                                                                                                                    mov word ptr [ebp-2Ch], ax
                                                                                                                                                                                    cmp dword ptr [ebp-0000013Ch], 0Ah
                                                                                                                                                                                    jnc 00007F9964B2274Ah
                                                                                                                                                                                    and word ptr [ebp-00000132h], 0000h
                                                                                                                                                                                    mov eax, dword ptr [ebp-00000134h]
                                                                                                                                                                                    movzx ecx, byte ptr [ebp-00000138h]
                                                                                                                                                                                    mov dword ptr [00434FB8h], eax
                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                    mov ah, byte ptr [ebp-0000013Ch]
                                                                                                                                                                                    movzx eax, ax
                                                                                                                                                                                    or eax, ecx
                                                                                                                                                                                    xor ecx, ecx
                                                                                                                                                                                    mov ch, byte ptr [ebp-2Ch]
                                                                                                                                                                                    movzx ecx, cx
                                                                                                                                                                                    shl eax, 10h
                                                                                                                                                                                    or eax, ecx

                                                                                                                                                                                    Rich Headers

                                                                                                                                                                                    Programming Language:
                                                                                                                                                                                    • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                    Data Directories

                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x86100xa0.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x6c0000x4f40.rsrc
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x2bd000x2968.data
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x80000x2b0.rdata
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                    Sections

                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                    .text0x10000x68970x6a00ce9df19df15aa7bfbc0a8d0af0b841d0False0.6661261792452831data6.458398214928006IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .rdata0x80000x14a60x1600a118375c929d970903c1204233b7583dFalse0.4392755681818182data5.024109281264143IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                    .data0xa0000x2b0180x60082a10c59a8679bb952fc8316070b8a6cFalse0.521484375data4.15458210408643IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                    .ndata0x360000x360000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                    .rsrc0x6c0000x4f400x50006147c56de0951034d77b52b0075b790fFalse0.1015625data2.760740823683962IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                    Resources

                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                    RT_ICON0x6c2080x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/mEnglishUnited States0.036372224846480866
                                                                                                                                                                                    RT_DIALOG0x704300x202dataEnglishUnited States0.4085603112840467
                                                                                                                                                                                    RT_DIALOG0x706380xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                    RT_DIALOG0x707300xa0dataEnglishUnited States0.60625
                                                                                                                                                                                    RT_DIALOG0x707d00xeedataEnglishUnited States0.6302521008403361
                                                                                                                                                                                    RT_GROUP_ICON0x708c00x14dataEnglishUnited States1.1
                                                                                                                                                                                    RT_VERSION0x708d80x240dataEnglishUnited States0.4895833333333333
                                                                                                                                                                                    RT_MANIFEST0x70b180x423XML 1.0 document, ASCII text, with very long lines (1059), with no line terminatorsEnglishUnited States0.5127478753541076

                                                                                                                                                                                    Imports

                                                                                                                                                                                    DLLImport
                                                                                                                                                                                    ADVAPI32.dllRegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
                                                                                                                                                                                    SHELL32.dllSHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
                                                                                                                                                                                    ole32.dllOleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
                                                                                                                                                                                    COMCTL32.dllImageList_Create, ImageList_Destroy, ImageList_AddMasked
                                                                                                                                                                                    USER32.dllGetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
                                                                                                                                                                                    GDI32.dllSetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
                                                                                                                                                                                    KERNEL32.dllGetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

                                                                                                                                                                                    Possible Origin

                                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                    ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                    Statistics

                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                    Behavior

                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                    System Behavior

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                    Start time:07:00:22
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Users\user\Desktop\Setup.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\Setup.exe"
                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                    File size:190'056 bytes
                                                                                                                                                                                    MD5 hash:C306C6AF9BD1955956F52ACC1C9327EA
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:1
                                                                                                                                                                                    Start time:07:00:29
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://pcapp.store/installing.php?guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0&winver=19045&version=fa.1092c&nocache=20241031070029.271&_fcid=1730271248380473
                                                                                                                                                                                    Imagebase:0x7ff76e190000
                                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                    Start time:07:00:30
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                    Imagebase:0x7ff76e190000
                                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                    Start time:07:00:35
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5184 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                    Imagebase:0x7ff76e190000
                                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                    Start time:07:00:35
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=2024,i,2326540136548541943,16570278364610659642,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                    Imagebase:0x7ff76e190000
                                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                    Start time:07:00:48
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\nsq4808.tmp
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force
                                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                                    File size:93'386'616 bytes
                                                                                                                                                                                    MD5 hash:84EE733F8014D22DAD2DFEF725489980
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                    • Detection: 29%, ReversingLabs
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:10
                                                                                                                                                                                    Start time:07:01:23
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Users\user\PCAppStore\PcAppStore.exe" /init default
                                                                                                                                                                                    Imagebase:0x7ff71abe0000
                                                                                                                                                                                    File size:3'116'888 bytes
                                                                                                                                                                                    MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                    • Detection: 5%, ReversingLabs
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                    Start time:07:01:23
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Users\user\PCAppStore\Watchdog.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Users\user\PCAppStore\Watchdog.exe" /guid=71434D56-1548-ED3D-AEE6-C75AECD93BF0 /rid=20241031070123.8585445468 /ver=fa.1092c
                                                                                                                                                                                    Imagebase:0x7ff75c470000
                                                                                                                                                                                    File size:276'312 bytes
                                                                                                                                                                                    MD5 hash:11F3801CB9FF046D6075F681971C4EB8
                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                                    • Detection: 5%, ReversingLabs
                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                    Start time:07:01:24
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Windows\explorer.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                    Imagebase:0x7ff72b770000
                                                                                                                                                                                    File size:5'141'208 bytes
                                                                                                                                                                                    MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:14
                                                                                                                                                                                    Start time:07:01:31
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                    Start time:07:01:32
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                    Start time:07:01:32
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                    Start time:07:01:32
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                    Start time:07:01:32
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:20
                                                                                                                                                                                    Start time:07:01:33
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                    Start time:07:01:34
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:22
                                                                                                                                                                                    Start time:07:01:34
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                    Start time:07:01:35
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:24
                                                                                                                                                                                    Start time:07:01:35
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:26
                                                                                                                                                                                    Start time:07:01:36
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:27
                                                                                                                                                                                    Start time:07:01:36
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:28
                                                                                                                                                                                    Start time:07:01:36
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                    Start time:07:01:37
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:30
                                                                                                                                                                                    Start time:07:01:37
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Users\user\PCAppStore\PcAppStore.exe
                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                    Commandline:"C:\Users\user\PCAppStore\PCAppStore.exe" /init default
                                                                                                                                                                                    Imagebase:0x7ff71abe0000
                                                                                                                                                                                    File size:3'116'888 bytes
                                                                                                                                                                                    MD5 hash:4B88D8ADA8D22622C30D581FC38EAA52
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:31
                                                                                                                                                                                    Start time:07:01:37
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:32
                                                                                                                                                                                    Start time:07:01:37
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:33
                                                                                                                                                                                    Start time:07:01:37
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:34
                                                                                                                                                                                    Start time:07:01:38
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:35
                                                                                                                                                                                    Start time:07:01:38
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:36
                                                                                                                                                                                    Start time:07:01:38
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:37
                                                                                                                                                                                    Start time:07:01:38
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:38
                                                                                                                                                                                    Start time:07:01:39
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:39
                                                                                                                                                                                    Start time:07:01:39
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:40
                                                                                                                                                                                    Start time:07:01:39
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:41
                                                                                                                                                                                    Start time:07:01:39
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:42
                                                                                                                                                                                    Start time:07:01:39
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:43
                                                                                                                                                                                    Start time:07:01:40
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    General

                                                                                                                                                                                    Target ID:44
                                                                                                                                                                                    Start time:07:01:40
                                                                                                                                                                                    Start date:31/10/2024
                                                                                                                                                                                    Path:C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe
                                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                                    Commandline:"C:\Program Files (x86)\DrSXXVmHpZDxFgrRfOEBCcSJhLjFyVbPIcJlABnTLoDKq\WCKsatFYtLNCcBGzYutkrweBluUg.exe"
                                                                                                                                                                                    Imagebase:0xc60000
                                                                                                                                                                                    File size:140'800 bytes
                                                                                                                                                                                    MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                    Disassembly

                                                                                                                                                                                    Reset < >

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:28.9%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:16.6%
                                                                                                                                                                                      Total number of Nodes:1349
                                                                                                                                                                                      Total number of Limit Nodes:40
                                                                                                                                                                                      execution_graph 2924 4015c1 2943 402da6 2924->2943 2928 401631 2930 401663 2928->2930 2931 401636 2928->2931 2933 401423 24 API calls 2930->2933 2970 401423 2931->2970 2940 40165b 2933->2940 2938 40164a SetCurrentDirectoryW 2938->2940 2939 401617 GetFileAttributesW 2941 4015d1 2939->2941 2941->2928 2941->2939 2955 405e39 2941->2955 2959 405b08 2941->2959 2962 405a6e CreateDirectoryW 2941->2962 2967 405aeb CreateDirectoryW 2941->2967 2944 402db2 2943->2944 2974 40657a 2944->2974 2947 4015c8 2949 405eb7 CharNextW CharNextW 2947->2949 2950 405ed4 2949->2950 2954 405ee6 2949->2954 2951 405ee1 CharNextW 2950->2951 2950->2954 2952 405f0a 2951->2952 2952->2941 2953 405e39 CharNextW 2953->2954 2954->2952 2954->2953 2956 405e3f 2955->2956 2957 405e55 2956->2957 2958 405e46 CharNextW 2956->2958 2957->2941 2958->2956 3012 40690a GetModuleHandleA 2959->3012 2963 405abb 2962->2963 2964 405abf GetLastError 2962->2964 2963->2941 2964->2963 2965 405ace SetFileSecurityW 2964->2965 2965->2963 2966 405ae4 GetLastError 2965->2966 2966->2963 2968 405afb 2967->2968 2969 405aff GetLastError 2967->2969 2968->2941 2969->2968 3021 40559f 2970->3021 2973 40653d lstrcpynW 2973->2938 2978 406587 2974->2978 2975 4067aa 2976 402dd3 2975->2976 3007 40653d lstrcpynW 2975->3007 2976->2947 2991 4067c4 2976->2991 2978->2975 2979 406778 lstrlenW 2978->2979 2982 40657a 10 API calls 2978->2982 2983 40668f GetSystemDirectoryW 2978->2983 2985 4066a2 GetWindowsDirectoryW 2978->2985 2986 406719 lstrcatW 2978->2986 2987 40657a 10 API calls 2978->2987 2988 4067c4 5 API calls 2978->2988 2989 4066d1 SHGetSpecialFolderLocation 2978->2989 3000 40640b 2978->3000 3005 406484 wsprintfW 2978->3005 3006 40653d lstrcpynW 2978->3006 2979->2978 2982->2979 2983->2978 2985->2978 2986->2978 2987->2978 2988->2978 2989->2978 2990 4066e9 SHGetPathFromIDListW CoTaskMemFree 2989->2990 2990->2978 2997 4067d1 2991->2997 2992 406847 2993 40684c CharPrevW 2992->2993 2995 40686d 2992->2995 2993->2992 2994 40683a CharNextW 2994->2992 2994->2997 2995->2947 2996 405e39 CharNextW 2996->2997 2997->2992 2997->2994 2997->2996 2998 406826 CharNextW 2997->2998 2999 406835 CharNextW 2997->2999 2998->2997 2999->2994 3008 4063aa 3000->3008 3003 40646f 3003->2978 3004 40643f RegQueryValueExW RegCloseKey 3004->3003 3005->2978 3006->2978 3007->2976 3009 4063b9 3008->3009 3010 4063c2 RegOpenKeyExW 3009->3010 3011 4063bd 3009->3011 3010->3011 3011->3003 3011->3004 3013 406930 GetProcAddress 3012->3013 3014 406926 3012->3014 3016 405b0f 3013->3016 3018 40689a GetSystemDirectoryW 3014->3018 3016->2941 3017 40692c 3017->3013 3017->3016 3019 4068bc wsprintfW LoadLibraryExW 3018->3019 3019->3017 3022 4055ba 3021->3022 3023 401431 3021->3023 3024 4055d6 lstrlenW 3022->3024 3025 40657a 17 API calls 3022->3025 3023->2973 3026 4055e4 lstrlenW 3024->3026 3027 4055ff 3024->3027 3025->3024 3026->3023 3028 4055f6 lstrcatW 3026->3028 3029 405612 3027->3029 3030 405605 SetWindowTextW 3027->3030 3028->3027 3029->3023 3031 405618 SendMessageW SendMessageW SendMessageW 3029->3031 3030->3029 3031->3023 3032 401941 3033 401943 3032->3033 3034 402da6 17 API calls 3033->3034 3035 401948 3034->3035 3038 405c49 3035->3038 3074 405f14 3038->3074 3041 405c71 DeleteFileW 3072 401951 3041->3072 3042 405c88 3043 405da8 3042->3043 3088 40653d lstrcpynW 3042->3088 3043->3072 3106 406873 FindFirstFileW 3043->3106 3045 405cae 3046 405cc1 3045->3046 3047 405cb4 lstrcatW 3045->3047 3089 405e58 lstrlenW 3046->3089 3049 405cc7 3047->3049 3051 405cd7 lstrcatW 3049->3051 3053 405ce2 lstrlenW FindFirstFileW 3049->3053 3051->3053 3053->3043 3065 405d04 3053->3065 3056 405d8b FindNextFileW 3060 405da1 FindClose 3056->3060 3056->3065 3057 405c01 5 API calls 3059 405de3 3057->3059 3061 405de7 3059->3061 3062 405dfd 3059->3062 3060->3043 3066 40559f 24 API calls 3061->3066 3061->3072 3064 40559f 24 API calls 3062->3064 3064->3072 3065->3056 3067 405c49 60 API calls 3065->3067 3069 40559f 24 API calls 3065->3069 3071 40559f 24 API calls 3065->3071 3093 40653d lstrcpynW 3065->3093 3094 405c01 3065->3094 3102 4062fd MoveFileExW 3065->3102 3068 405df4 3066->3068 3067->3065 3070 4062fd 36 API calls 3068->3070 3069->3056 3070->3072 3071->3065 3112 40653d lstrcpynW 3074->3112 3076 405f25 3077 405eb7 4 API calls 3076->3077 3078 405f2b 3077->3078 3079 405c69 3078->3079 3080 4067c4 5 API calls 3078->3080 3079->3041 3079->3042 3086 405f3b 3080->3086 3081 405f6c lstrlenW 3082 405f77 3081->3082 3081->3086 3084 405e0c 3 API calls 3082->3084 3083 406873 2 API calls 3083->3086 3085 405f7c GetFileAttributesW 3084->3085 3085->3079 3086->3079 3086->3081 3086->3083 3087 405e58 2 API calls 3086->3087 3087->3081 3088->3045 3090 405e66 3089->3090 3091 405e78 3090->3091 3092 405e6c CharPrevW 3090->3092 3091->3049 3092->3090 3092->3091 3093->3065 3113 406008 GetFileAttributesW 3094->3113 3097 405c2e 3097->3065 3098 405c24 DeleteFileW 3100 405c2a 3098->3100 3099 405c1c RemoveDirectoryW 3099->3100 3100->3097 3101 405c3a SetFileAttributesW 3100->3101 3101->3097 3103 406311 3102->3103 3105 40631e 3102->3105 3116 406183 3103->3116 3105->3065 3107 405dcd 3106->3107 3108 406889 FindClose 3106->3108 3107->3072 3109 405e0c lstrlenW CharPrevW 3107->3109 3108->3107 3110 405dd7 3109->3110 3111 405e28 lstrcatW 3109->3111 3110->3057 3111->3110 3112->3076 3114 405c0d 3113->3114 3115 40601a SetFileAttributesW 3113->3115 3114->3097 3114->3098 3114->3099 3115->3114 3117 4061b3 3116->3117 3118 4061d9 GetShortPathNameW 3116->3118 3143 40602d GetFileAttributesW CreateFileW 3117->3143 3120 4062f8 3118->3120 3121 4061ee 3118->3121 3120->3105 3121->3120 3123 4061f6 wsprintfA 3121->3123 3122 4061bd CloseHandle GetShortPathNameW 3122->3120 3124 4061d1 3122->3124 3125 40657a 17 API calls 3123->3125 3124->3118 3124->3120 3126 40621e 3125->3126 3144 40602d GetFileAttributesW CreateFileW 3126->3144 3128 40622b 3128->3120 3129 40623a GetFileSize GlobalAlloc 3128->3129 3130 4062f1 CloseHandle 3129->3130 3131 40625c 3129->3131 3130->3120 3145 4060b0 ReadFile 3131->3145 3136 40627b lstrcpyA 3139 40629d 3136->3139 3137 40628f 3138 405f92 4 API calls 3137->3138 3138->3139 3140 4062d4 SetFilePointer 3139->3140 3152 4060df WriteFile 3140->3152 3143->3122 3144->3128 3146 4060ce 3145->3146 3146->3130 3147 405f92 lstrlenA 3146->3147 3148 405fd3 lstrlenA 3147->3148 3149 405fdb 3148->3149 3150 405fac lstrcmpiA 3148->3150 3149->3136 3149->3137 3150->3149 3151 405fca CharNextA 3150->3151 3151->3148 3153 4060fd GlobalFree 3152->3153 3153->3130 3168 401c43 3169 402d84 17 API calls 3168->3169 3170 401c4a 3169->3170 3171 402d84 17 API calls 3170->3171 3172 401c57 3171->3172 3173 401c6c 3172->3173 3174 402da6 17 API calls 3172->3174 3175 401c7c 3173->3175 3176 402da6 17 API calls 3173->3176 3174->3173 3177 401cd3 3175->3177 3178 401c87 3175->3178 3176->3175 3180 402da6 17 API calls 3177->3180 3179 402d84 17 API calls 3178->3179 3182 401c8c 3179->3182 3181 401cd8 3180->3181 3183 402da6 17 API calls 3181->3183 3184 402d84 17 API calls 3182->3184 3185 401ce1 FindWindowExW 3183->3185 3186 401c98 3184->3186 3189 401d03 3185->3189 3187 401cc3 SendMessageW 3186->3187 3188 401ca5 SendMessageTimeoutW 3186->3188 3187->3189 3188->3189 3834 404943 3835 404953 3834->3835 3836 404979 3834->3836 3837 404499 18 API calls 3835->3837 3838 404500 8 API calls 3836->3838 3839 404960 SetDlgItemTextW 3837->3839 3840 404985 3838->3840 3839->3836 3841 4028c4 3842 4028ca 3841->3842 3843 4028d2 FindClose 3842->3843 3844 402c2a 3842->3844 3843->3844 3848 4016cc 3849 402da6 17 API calls 3848->3849 3850 4016d2 GetFullPathNameW 3849->3850 3851 4016ec 3850->3851 3857 40170e 3850->3857 3854 406873 2 API calls 3851->3854 3851->3857 3852 401723 GetShortPathNameW 3853 402c2a 3852->3853 3855 4016fe 3854->3855 3855->3857 3858 40653d lstrcpynW 3855->3858 3857->3852 3857->3853 3858->3857 3859 401e4e GetDC 3860 402d84 17 API calls 3859->3860 3861 401e60 GetDeviceCaps MulDiv ReleaseDC 3860->3861 3862 402d84 17 API calls 3861->3862 3863 401e91 3862->3863 3864 40657a 17 API calls 3863->3864 3865 401ece CreateFontIndirectW 3864->3865 3866 402638 3865->3866 3867 4045cf lstrcpynW lstrlenW 3868 402950 3869 402da6 17 API calls 3868->3869 3871 40295c 3869->3871 3870 402972 3873 406008 2 API calls 3870->3873 3871->3870 3872 402da6 17 API calls 3871->3872 3872->3870 3874 402978 3873->3874 3896 40602d GetFileAttributesW CreateFileW 3874->3896 3876 402985 3877 402a3b 3876->3877 3878 4029a0 GlobalAlloc 3876->3878 3879 402a23 3876->3879 3880 402a42 DeleteFileW 3877->3880 3881 402a55 3877->3881 3878->3879 3882 4029b9 3878->3882 3883 4032b4 31 API calls 3879->3883 3880->3881 3897 4034e5 SetFilePointer 3882->3897 3885 402a30 CloseHandle 3883->3885 3885->3877 3886 4029bf 3887 4034cf ReadFile 3886->3887 3888 4029c8 GlobalAlloc 3887->3888 3889 4029d8 3888->3889 3890 402a0c 3888->3890 3891 4032b4 31 API calls 3889->3891 3892 4060df WriteFile 3890->3892 3895 4029e5 3891->3895 3893 402a18 GlobalFree 3892->3893 3893->3879 3894 402a03 GlobalFree 3894->3890 3895->3894 3896->3876 3897->3886 3898 401956 3899 402da6 17 API calls 3898->3899 3900 40195d lstrlenW 3899->3900 3901 402638 3900->3901 3902 4014d7 3903 402d84 17 API calls 3902->3903 3904 4014dd Sleep 3903->3904 3906 402c2a 3904->3906 3617 4020d8 3618 4020ea 3617->3618 3628 40219c 3617->3628 3619 402da6 17 API calls 3618->3619 3621 4020f1 3619->3621 3620 401423 24 API calls 3626 4022f6 3620->3626 3622 402da6 17 API calls 3621->3622 3623 4020fa 3622->3623 3624 402110 LoadLibraryExW 3623->3624 3625 402102 GetModuleHandleW 3623->3625 3627 402121 3624->3627 3624->3628 3625->3624 3625->3627 3637 406979 3627->3637 3628->3620 3631 402132 3634 401423 24 API calls 3631->3634 3635 402142 3631->3635 3632 40216b 3633 40559f 24 API calls 3632->3633 3633->3635 3634->3635 3635->3626 3636 40218e FreeLibrary 3635->3636 3636->3626 3642 40655f WideCharToMultiByte 3637->3642 3639 406996 3640 40699d GetProcAddress 3639->3640 3641 40212c 3639->3641 3640->3641 3641->3631 3641->3632 3642->3639 3907 404658 3908 404670 3907->3908 3914 40478a 3907->3914 3915 404499 18 API calls 3908->3915 3909 4047f4 3910 4048be 3909->3910 3911 4047fe GetDlgItem 3909->3911 3916 404500 8 API calls 3910->3916 3912 404818 3911->3912 3913 40487f 3911->3913 3912->3913 3920 40483e SendMessageW LoadCursorW SetCursor 3912->3920 3913->3910 3921 404891 3913->3921 3914->3909 3914->3910 3917 4047c5 GetDlgItem SendMessageW 3914->3917 3918 4046d7 3915->3918 3919 4048b9 3916->3919 3940 4044bb KiUserCallbackDispatcher 3917->3940 3923 404499 18 API calls 3918->3923 3944 404907 3920->3944 3926 4048a7 3921->3926 3927 404897 SendMessageW 3921->3927 3924 4046e4 CheckDlgButton 3923->3924 3938 4044bb KiUserCallbackDispatcher 3924->3938 3926->3919 3931 4048ad SendMessageW 3926->3931 3927->3926 3928 4047ef 3941 4048e3 3928->3941 3931->3919 3933 404702 GetDlgItem 3939 4044ce SendMessageW 3933->3939 3935 404718 SendMessageW 3936 404735 GetSysColor 3935->3936 3937 40473e SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 3935->3937 3936->3937 3937->3919 3938->3933 3939->3935 3940->3928 3942 4048f1 3941->3942 3943 4048f6 SendMessageW 3941->3943 3942->3943 3943->3909 3947 405b63 ShellExecuteExW 3944->3947 3946 40486d LoadCursorW SetCursor 3946->3913 3947->3946 3948 402b59 3949 402b60 3948->3949 3950 402bab 3948->3950 3953 402d84 17 API calls 3949->3953 3956 402ba9 3949->3956 3951 40690a 5 API calls 3950->3951 3952 402bb2 3951->3952 3954 402da6 17 API calls 3952->3954 3955 402b6e 3953->3955 3957 402bbb 3954->3957 3958 402d84 17 API calls 3955->3958 3957->3956 3959 402bbf IIDFromString 3957->3959 3961 402b7a 3958->3961 3959->3956 3960 402bce 3959->3960 3960->3956 3966 40653d lstrcpynW 3960->3966 3965 406484 wsprintfW 3961->3965 3964 402beb CoTaskMemFree 3964->3956 3965->3956 3966->3964 3760 40175c 3761 402da6 17 API calls 3760->3761 3762 401763 3761->3762 3763 40605c 2 API calls 3762->3763 3764 40176a 3763->3764 3765 40605c 2 API calls 3764->3765 3765->3764 3967 401d5d 3968 402d84 17 API calls 3967->3968 3969 401d6e SetWindowLongW 3968->3969 3970 402c2a 3969->3970 3766 4056de 3767 405888 3766->3767 3768 4056ff GetDlgItem GetDlgItem GetDlgItem 3766->3768 3770 405891 GetDlgItem CreateThread CloseHandle 3767->3770 3771 4058b9 3767->3771 3811 4044ce SendMessageW 3768->3811 3770->3771 3814 405672 5 API calls 3770->3814 3773 4058e4 3771->3773 3775 4058d0 ShowWindow ShowWindow 3771->3775 3776 405909 3771->3776 3772 40576f 3780 405776 GetClientRect GetSystemMetrics SendMessageW SendMessageW 3772->3780 3774 405944 3773->3774 3777 4058f8 3773->3777 3778 40591e ShowWindow 3773->3778 3774->3776 3787 405952 SendMessageW 3774->3787 3813 4044ce SendMessageW 3775->3813 3779 404500 8 API calls 3776->3779 3782 404472 SendMessageW 3777->3782 3783 405930 3778->3783 3784 40593e 3778->3784 3792 405917 3779->3792 3785 4057e4 3780->3785 3786 4057c8 SendMessageW SendMessageW 3780->3786 3782->3776 3788 40559f 24 API calls 3783->3788 3789 404472 SendMessageW 3784->3789 3790 4057f7 3785->3790 3791 4057e9 SendMessageW 3785->3791 3786->3785 3787->3792 3793 40596b CreatePopupMenu 3787->3793 3788->3784 3789->3774 3795 404499 18 API calls 3790->3795 3791->3790 3794 40657a 17 API calls 3793->3794 3796 40597b AppendMenuW 3794->3796 3797 405807 3795->3797 3798 405998 GetWindowRect 3796->3798 3799 4059ab TrackPopupMenu 3796->3799 3800 405810 ShowWindow 3797->3800 3801 405844 GetDlgItem SendMessageW 3797->3801 3798->3799 3799->3792 3802 4059c6 3799->3802 3803 405833 3800->3803 3804 405826 ShowWindow 3800->3804 3801->3792 3805 40586b SendMessageW SendMessageW 3801->3805 3806 4059e2 SendMessageW 3802->3806 3812 4044ce SendMessageW 3803->3812 3804->3803 3805->3792 3806->3806 3807 4059ff OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3806->3807 3809 405a24 SendMessageW 3807->3809 3809->3809 3810 405a4d GlobalUnlock SetClipboardData CloseClipboard 3809->3810 3810->3792 3811->3772 3812->3801 3813->3773 3815 401ede 3816 402d84 17 API calls 3815->3816 3817 401ee4 3816->3817 3818 402d84 17 API calls 3817->3818 3819 401ef0 3818->3819 3820 401f07 EnableWindow 3819->3820 3821 401efc ShowWindow 3819->3821 3822 402c2a 3820->3822 3821->3822 3971 4028de 3972 4028e6 3971->3972 3973 4028ea FindNextFileW 3972->3973 3976 4028fc 3972->3976 3974 402943 3973->3974 3973->3976 3977 40653d lstrcpynW 3974->3977 3977->3976 3978 404ce0 3979 404cf0 3978->3979 3980 404d0c 3978->3980 3989 405b81 GetDlgItemTextW 3979->3989 3981 404d12 SHGetPathFromIDListW 3980->3981 3982 404d3f 3980->3982 3984 404d29 SendMessageW 3981->3984 3985 404d22 3981->3985 3984->3982 3987 40140b 2 API calls 3985->3987 3986 404cfd SendMessageW 3986->3980 3987->3984 3989->3986 3190 405b63 ShellExecuteExW 3990 401563 3991 402ba4 3990->3991 3994 406484 wsprintfW 3991->3994 3993 402ba9 3994->3993 3995 401968 3996 402d84 17 API calls 3995->3996 3997 40196f 3996->3997 3998 402d84 17 API calls 3997->3998 3999 40197c 3998->3999 4000 402da6 17 API calls 3999->4000 4001 401993 lstrlenW 4000->4001 4002 4019a4 4001->4002 4006 4019e5 4002->4006 4007 40653d lstrcpynW 4002->4007 4004 4019d5 4005 4019da lstrlenW 4004->4005 4004->4006 4005->4006 4007->4004 4008 40166a 4009 402da6 17 API calls 4008->4009 4010 401670 4009->4010 4011 406873 2 API calls 4010->4011 4012 401676 4011->4012 4013 402aeb 4014 402d84 17 API calls 4013->4014 4015 402af1 4014->4015 4016 40292e 4015->4016 4017 40657a 17 API calls 4015->4017 4017->4016 3286 4026ec 3287 402d84 17 API calls 3286->3287 3288 4026fb 3287->3288 3289 402745 ReadFile 3288->3289 3290 4060b0 ReadFile 3288->3290 3291 4027de 3288->3291 3293 402785 MultiByteToWideChar 3288->3293 3294 40283a 3288->3294 3296 4027ab SetFilePointer MultiByteToWideChar 3288->3296 3297 40284b 3288->3297 3299 402838 3288->3299 3289->3288 3289->3299 3290->3288 3291->3288 3291->3299 3300 40610e SetFilePointer 3291->3300 3293->3288 3309 406484 wsprintfW 3294->3309 3296->3288 3298 40286c SetFilePointer 3297->3298 3297->3299 3298->3299 3301 40612a 3300->3301 3304 406142 3300->3304 3302 4060b0 ReadFile 3301->3302 3303 406136 3302->3303 3303->3304 3305 406173 SetFilePointer 3303->3305 3306 40614b SetFilePointer 3303->3306 3304->3291 3305->3304 3306->3305 3307 406156 3306->3307 3308 4060df WriteFile 3307->3308 3308->3304 3309->3299 3556 40176f 3557 402da6 17 API calls 3556->3557 3558 401776 3557->3558 3559 401796 3558->3559 3560 40179e 3558->3560 3595 40653d lstrcpynW 3559->3595 3596 40653d lstrcpynW 3560->3596 3563 40179c 3567 4067c4 5 API calls 3563->3567 3564 4017a9 3565 405e0c 3 API calls 3564->3565 3566 4017af lstrcatW 3565->3566 3566->3563 3584 4017bb 3567->3584 3568 406873 2 API calls 3568->3584 3569 406008 2 API calls 3569->3584 3571 4017cd CompareFileTime 3571->3584 3572 40188d 3574 40559f 24 API calls 3572->3574 3573 401864 3575 40559f 24 API calls 3573->3575 3579 401879 3573->3579 3577 401897 3574->3577 3575->3579 3576 40653d lstrcpynW 3576->3584 3578 4032b4 31 API calls 3577->3578 3580 4018aa 3578->3580 3581 4018be SetFileTime 3580->3581 3582 4018d0 CloseHandle 3580->3582 3581->3582 3582->3579 3585 4018e1 3582->3585 3583 40657a 17 API calls 3583->3584 3584->3568 3584->3569 3584->3571 3584->3572 3584->3573 3584->3576 3584->3583 3590 405b9d MessageBoxIndirectW 3584->3590 3594 40602d GetFileAttributesW CreateFileW 3584->3594 3586 4018e6 3585->3586 3587 4018f9 3585->3587 3588 40657a 17 API calls 3586->3588 3589 40657a 17 API calls 3587->3589 3591 4018ee lstrcatW 3588->3591 3592 401901 3589->3592 3590->3584 3591->3592 3593 405b9d MessageBoxIndirectW 3592->3593 3593->3579 3594->3584 3595->3563 3596->3564 4018 401a72 4019 402d84 17 API calls 4018->4019 4020 401a7b 4019->4020 4021 402d84 17 API calls 4020->4021 4022 401a20 4021->4022 4023 401573 4024 401583 ShowWindow 4023->4024 4025 40158c 4023->4025 4024->4025 4026 402c2a 4025->4026 4027 40159a ShowWindow 4025->4027 4027->4026 4028 4023f4 4029 402da6 17 API calls 4028->4029 4030 402403 4029->4030 4031 402da6 17 API calls 4030->4031 4032 40240c 4031->4032 4033 402da6 17 API calls 4032->4033 4034 402416 GetPrivateProfileStringW 4033->4034 4035 4014f5 SetForegroundWindow 4036 402c2a 4035->4036 4037 401ff6 4038 402da6 17 API calls 4037->4038 4039 401ffd 4038->4039 4040 406873 2 API calls 4039->4040 4041 402003 4040->4041 4043 402014 4041->4043 4044 406484 wsprintfW 4041->4044 4044->4043 4045 401b77 4046 402da6 17 API calls 4045->4046 4047 401b7e 4046->4047 4048 402d84 17 API calls 4047->4048 4049 401b87 wsprintfW 4048->4049 4050 402c2a 4049->4050 4051 40167b 4052 402da6 17 API calls 4051->4052 4053 401682 4052->4053 4054 402da6 17 API calls 4053->4054 4055 40168b 4054->4055 4056 402da6 17 API calls 4055->4056 4057 401694 MoveFileW 4056->4057 4058 4016a7 4057->4058 4064 4016a0 4057->4064 4060 406873 2 API calls 4058->4060 4062 4022f6 4058->4062 4059 401423 24 API calls 4059->4062 4061 4016b6 4060->4061 4061->4062 4063 4062fd 36 API calls 4061->4063 4063->4064 4064->4059 4065 4019ff 4066 402da6 17 API calls 4065->4066 4067 401a06 4066->4067 4068 402da6 17 API calls 4067->4068 4069 401a0f 4068->4069 4070 401a16 lstrcmpiW 4069->4070 4071 401a28 lstrcmpW 4069->4071 4072 401a1c 4070->4072 4071->4072 4073 4022ff 4074 402da6 17 API calls 4073->4074 4075 402305 4074->4075 4076 402da6 17 API calls 4075->4076 4077 40230e 4076->4077 4078 402da6 17 API calls 4077->4078 4079 402317 4078->4079 4080 406873 2 API calls 4079->4080 4081 402320 4080->4081 4082 402331 lstrlenW lstrlenW 4081->4082 4083 402324 4081->4083 4085 40559f 24 API calls 4082->4085 4084 40559f 24 API calls 4083->4084 4087 40232c 4083->4087 4084->4087 4086 40236f SHFileOperationW 4085->4086 4086->4083 4086->4087 4088 401000 4089 401037 BeginPaint GetClientRect 4088->4089 4090 40100c DefWindowProcW 4088->4090 4092 4010f3 4089->4092 4095 401179 4090->4095 4093 401073 CreateBrushIndirect FillRect DeleteObject 4092->4093 4094 4010fc 4092->4094 4093->4092 4096 401102 CreateFontIndirectW 4094->4096 4097 401167 EndPaint 4094->4097 4096->4097 4098 401112 6 API calls 4096->4098 4097->4095 4098->4097 3154 401d81 3155 401d94 GetDlgItem 3154->3155 3156 401d87 3154->3156 3157 401d8e 3155->3157 3165 402d84 3156->3165 3159 401dd5 GetClientRect LoadImageW SendMessageW 3157->3159 3160 402da6 17 API calls 3157->3160 3162 401e33 3159->3162 3164 401e3f 3159->3164 3160->3159 3163 401e38 DeleteObject 3162->3163 3162->3164 3163->3164 3166 40657a 17 API calls 3165->3166 3167 402d99 3166->3167 3167->3157 4099 401503 4100 40150b 4099->4100 4102 40151e 4099->4102 4101 402d84 17 API calls 4100->4101 4101->4102 4103 402383 4104 40238a 4103->4104 4107 40239d 4103->4107 4105 40657a 17 API calls 4104->4105 4106 402397 4105->4106 4108 405b9d MessageBoxIndirectW 4106->4108 4108->4107 3217 402c05 SendMessageW 3218 402c2a 3217->3218 3219 402c1f InvalidateRect 3217->3219 3219->3218 4109 404f06 GetDlgItem GetDlgItem 4110 404f58 7 API calls 4109->4110 4116 40517d 4109->4116 4111 404ff2 SendMessageW 4110->4111 4112 404fff DeleteObject 4110->4112 4111->4112 4113 405008 4112->4113 4114 40503f 4113->4114 4117 40657a 17 API calls 4113->4117 4118 404499 18 API calls 4114->4118 4115 40525f 4119 40530b 4115->4119 4129 4052b8 SendMessageW 4115->4129 4149 405170 4115->4149 4116->4115 4120 4051ec 4116->4120 4163 404e54 SendMessageW 4116->4163 4123 405021 SendMessageW SendMessageW 4117->4123 4124 405053 4118->4124 4121 405315 SendMessageW 4119->4121 4122 40531d 4119->4122 4120->4115 4125 405251 SendMessageW 4120->4125 4121->4122 4131 405336 4122->4131 4132 40532f ImageList_Destroy 4122->4132 4147 405346 4122->4147 4123->4113 4128 404499 18 API calls 4124->4128 4125->4115 4126 404500 8 API calls 4130 40550c 4126->4130 4142 405064 4128->4142 4134 4052cd SendMessageW 4129->4134 4129->4149 4135 40533f GlobalFree 4131->4135 4131->4147 4132->4131 4133 4054c0 4138 4054d2 ShowWindow GetDlgItem ShowWindow 4133->4138 4133->4149 4137 4052e0 4134->4137 4135->4147 4136 40513f GetWindowLongW SetWindowLongW 4139 405158 4136->4139 4148 4052f1 SendMessageW 4137->4148 4138->4149 4140 405175 4139->4140 4141 40515d ShowWindow 4139->4141 4162 4044ce SendMessageW 4140->4162 4161 4044ce SendMessageW 4141->4161 4142->4136 4143 40513a 4142->4143 4146 4050b7 SendMessageW 4142->4146 4150 4050f5 SendMessageW 4142->4150 4151 405109 SendMessageW 4142->4151 4143->4136 4143->4139 4146->4142 4147->4133 4154 405381 4147->4154 4168 404ed4 4147->4168 4148->4119 4149->4126 4150->4142 4151->4142 4153 40548b 4155 405496 InvalidateRect 4153->4155 4158 4054a2 4153->4158 4156 4053af SendMessageW 4154->4156 4157 4053c5 4154->4157 4155->4158 4156->4157 4157->4153 4159 405439 SendMessageW SendMessageW 4157->4159 4158->4133 4177 404e0f 4158->4177 4159->4157 4161->4149 4162->4116 4164 404eb3 SendMessageW 4163->4164 4165 404e77 GetMessagePos ScreenToClient SendMessageW 4163->4165 4167 404eab 4164->4167 4166 404eb0 4165->4166 4165->4167 4166->4164 4167->4120 4180 40653d lstrcpynW 4168->4180 4170 404ee7 4181 406484 wsprintfW 4170->4181 4172 404ef1 4173 40140b 2 API calls 4172->4173 4174 404efa 4173->4174 4182 40653d lstrcpynW 4174->4182 4176 404f01 4176->4154 4183 404d46 4177->4183 4179 404e24 4179->4133 4180->4170 4181->4172 4182->4176 4184 404d5f 4183->4184 4185 40657a 17 API calls 4184->4185 4186 404dc3 4185->4186 4187 40657a 17 API calls 4186->4187 4188 404dce 4187->4188 4189 40657a 17 API calls 4188->4189 4190 404de4 lstrlenW wsprintfW SetDlgItemTextW 4189->4190 4190->4179 4191 404609 lstrlenW 4192 404628 4191->4192 4193 40462a WideCharToMultiByte 4191->4193 4192->4193 3220 40248a 3221 402da6 17 API calls 3220->3221 3222 40249c 3221->3222 3223 402da6 17 API calls 3222->3223 3224 4024a6 3223->3224 3237 402e36 3224->3237 3227 40292e 3228 4024de 3230 4024ea 3228->3230 3232 402d84 17 API calls 3228->3232 3229 402da6 17 API calls 3231 4024d4 lstrlenW 3229->3231 3233 402509 RegSetValueExW 3230->3233 3241 4032b4 3230->3241 3231->3228 3232->3230 3235 40251f RegCloseKey 3233->3235 3235->3227 3238 402e51 3237->3238 3261 4063d8 3238->3261 3242 4032cd 3241->3242 3243 4032fb 3242->3243 3268 4034e5 SetFilePointer 3242->3268 3265 4034cf 3243->3265 3247 403468 3249 4034aa 3247->3249 3252 40346c 3247->3252 3248 403318 GetTickCount 3253 403452 3248->3253 3257 403367 3248->3257 3250 4034cf ReadFile 3249->3250 3250->3253 3251 4034cf ReadFile 3251->3257 3252->3253 3254 4034cf ReadFile 3252->3254 3255 4060df WriteFile 3252->3255 3253->3233 3254->3252 3255->3252 3256 4033bd GetTickCount 3256->3257 3257->3251 3257->3253 3257->3256 3258 4033e2 MulDiv wsprintfW 3257->3258 3260 4060df WriteFile 3257->3260 3259 40559f 24 API calls 3258->3259 3259->3257 3260->3257 3262 4063e7 3261->3262 3263 4063f2 RegCreateKeyExW 3262->3263 3264 4024b6 3262->3264 3263->3264 3264->3227 3264->3228 3264->3229 3266 4060b0 ReadFile 3265->3266 3267 403306 3266->3267 3267->3247 3267->3248 3267->3253 3268->3243 4194 40498a 4195 4049b6 4194->4195 4196 4049c7 4194->4196 4255 405b81 GetDlgItemTextW 4195->4255 4197 4049d3 GetDlgItem 4196->4197 4204 404a32 4196->4204 4200 4049e7 4197->4200 4199 4049c1 4202 4067c4 5 API calls 4199->4202 4203 4049fb SetWindowTextW 4200->4203 4207 405eb7 4 API calls 4200->4207 4201 404b16 4253 404cc5 4201->4253 4257 405b81 GetDlgItemTextW 4201->4257 4202->4196 4208 404499 18 API calls 4203->4208 4204->4201 4209 40657a 17 API calls 4204->4209 4204->4253 4206 404500 8 API calls 4211 404cd9 4206->4211 4212 4049f1 4207->4212 4213 404a17 4208->4213 4214 404aa6 SHBrowseForFolderW 4209->4214 4210 404b46 4215 405f14 18 API calls 4210->4215 4212->4203 4219 405e0c 3 API calls 4212->4219 4216 404499 18 API calls 4213->4216 4214->4201 4217 404abe CoTaskMemFree 4214->4217 4218 404b4c 4215->4218 4220 404a25 4216->4220 4221 405e0c 3 API calls 4217->4221 4258 40653d lstrcpynW 4218->4258 4219->4203 4256 4044ce SendMessageW 4220->4256 4223 404acb 4221->4223 4226 404b02 SetDlgItemTextW 4223->4226 4230 40657a 17 API calls 4223->4230 4225 404a2b 4228 40690a 5 API calls 4225->4228 4226->4201 4227 404b63 4229 40690a 5 API calls 4227->4229 4228->4204 4241 404b6a 4229->4241 4231 404aea lstrcmpiW 4230->4231 4231->4226 4233 404afb lstrcatW 4231->4233 4232 404bab 4259 40653d lstrcpynW 4232->4259 4233->4226 4235 404bb2 4236 405eb7 4 API calls 4235->4236 4237 404bb8 GetDiskFreeSpaceW 4236->4237 4239 404bdc MulDiv 4237->4239 4243 404c03 4237->4243 4239->4243 4240 405e58 2 API calls 4240->4241 4241->4232 4241->4240 4241->4243 4242 404c74 4245 404c97 4242->4245 4247 40140b 2 API calls 4242->4247 4243->4242 4244 404e0f 20 API calls 4243->4244 4246 404c61 4244->4246 4260 4044bb KiUserCallbackDispatcher 4245->4260 4248 404c76 SetDlgItemTextW 4246->4248 4249 404c66 4246->4249 4247->4245 4248->4242 4251 404d46 20 API calls 4249->4251 4251->4242 4252 404cb3 4252->4253 4254 4048e3 SendMessageW 4252->4254 4253->4206 4254->4253 4255->4199 4256->4225 4257->4210 4258->4227 4259->4235 4260->4252 4261 40290b 4262 402da6 17 API calls 4261->4262 4263 402912 FindFirstFileW 4262->4263 4264 40293a 4263->4264 4267 402925 4263->4267 4269 406484 wsprintfW 4264->4269 4266 402943 4270 40653d lstrcpynW 4266->4270 4269->4266 4270->4267 4271 40190c 4272 401943 4271->4272 4273 402da6 17 API calls 4272->4273 4274 401948 4273->4274 4275 405c49 67 API calls 4274->4275 4276 401951 4275->4276 4277 40190f 4278 402da6 17 API calls 4277->4278 4279 401916 4278->4279 4280 405b9d MessageBoxIndirectW 4279->4280 4281 40191f 4280->4281 3597 402891 3598 402898 3597->3598 3599 402ba9 3597->3599 3600 402d84 17 API calls 3598->3600 3601 40289f 3600->3601 3602 4028ae SetFilePointer 3601->3602 3602->3599 3603 4028be 3602->3603 3605 406484 wsprintfW 3603->3605 3605->3599 4282 401491 4283 40559f 24 API calls 4282->4283 4284 401498 4283->4284 3606 403b12 3607 403b2a 3606->3607 3608 403b1c CloseHandle 3606->3608 3613 403b57 3607->3613 3608->3607 3611 405c49 67 API calls 3612 403b3b 3611->3612 3615 403b65 3613->3615 3614 403b2f 3614->3611 3615->3614 3616 403b6a FreeLibrary GlobalFree 3615->3616 3616->3614 3616->3616 4285 401f12 4286 402da6 17 API calls 4285->4286 4287 401f18 4286->4287 4288 402da6 17 API calls 4287->4288 4289 401f21 4288->4289 4290 402da6 17 API calls 4289->4290 4291 401f2a 4290->4291 4292 402da6 17 API calls 4291->4292 4293 401f33 4292->4293 4294 401423 24 API calls 4293->4294 4295 401f3a 4294->4295 4302 405b63 ShellExecuteExW 4295->4302 4297 401f82 4298 40292e 4297->4298 4299 4069b5 5 API calls 4297->4299 4300 401f9f CloseHandle 4299->4300 4300->4298 4302->4297 4303 405513 4304 405523 4303->4304 4305 405537 4303->4305 4306 405580 4304->4306 4307 405529 4304->4307 4308 40553f IsWindowVisible 4305->4308 4314 405556 4305->4314 4309 405585 CallWindowProcW 4306->4309 4310 4044e5 SendMessageW 4307->4310 4308->4306 4311 40554c 4308->4311 4312 405533 4309->4312 4310->4312 4313 404e54 5 API calls 4311->4313 4313->4314 4314->4309 4315 404ed4 4 API calls 4314->4315 4315->4306 4316 402f93 4317 402fa5 SetTimer 4316->4317 4318 402fbe 4316->4318 4317->4318 4319 403013 4318->4319 4320 402fd8 MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4318->4320 4320->4319 4321 401d17 4322 402d84 17 API calls 4321->4322 4323 401d1d IsWindow 4322->4323 4324 401a20 4323->4324 3643 403f9a 3644 403fb2 3643->3644 3645 404113 3643->3645 3644->3645 3646 403fbe 3644->3646 3647 404164 3645->3647 3648 404124 GetDlgItem GetDlgItem 3645->3648 3650 403fc9 SetWindowPos 3646->3650 3651 403fdc 3646->3651 3649 4041be 3647->3649 3660 401389 2 API calls 3647->3660 3652 404499 18 API calls 3648->3652 3653 4044e5 SendMessageW 3649->3653 3661 40410e 3649->3661 3650->3651 3654 403fe5 ShowWindow 3651->3654 3655 404027 3651->3655 3656 40414e SetClassLongW 3652->3656 3682 4041d0 3653->3682 3662 4040d1 3654->3662 3663 404005 GetWindowLongW 3654->3663 3657 404046 3655->3657 3658 40402f DestroyWindow 3655->3658 3659 40140b 2 API calls 3656->3659 3665 40404b SetWindowLongW 3657->3665 3666 40405c 3657->3666 3664 404422 3658->3664 3659->3647 3667 404196 3660->3667 3723 404500 3662->3723 3663->3662 3669 40401e ShowWindow 3663->3669 3664->3661 3676 404453 ShowWindow 3664->3676 3665->3661 3666->3662 3670 404068 GetDlgItem 3666->3670 3667->3649 3671 40419a SendMessageW 3667->3671 3669->3655 3674 404096 3670->3674 3675 404079 SendMessageW IsWindowEnabled 3670->3675 3671->3661 3672 40140b 2 API calls 3672->3682 3673 404424 DestroyWindow KiUserCallbackDispatcher 3673->3664 3678 4040a3 3674->3678 3680 4040ea SendMessageW 3674->3680 3681 4040b6 3674->3681 3688 40409b 3674->3688 3675->3661 3675->3674 3676->3661 3677 40657a 17 API calls 3677->3682 3678->3680 3678->3688 3680->3662 3683 4040d3 3681->3683 3684 4040be 3681->3684 3682->3661 3682->3672 3682->3673 3682->3677 3685 404499 18 API calls 3682->3685 3705 404364 DestroyWindow 3682->3705 3714 404499 3682->3714 3686 40140b 2 API calls 3683->3686 3687 40140b 2 API calls 3684->3687 3685->3682 3686->3688 3687->3688 3688->3662 3720 404472 3688->3720 3690 40424b GetDlgItem 3691 404260 3690->3691 3692 404268 ShowWindow KiUserCallbackDispatcher 3690->3692 3691->3692 3717 4044bb KiUserCallbackDispatcher 3692->3717 3694 404292 KiUserCallbackDispatcher 3699 4042a6 3694->3699 3695 4042ab GetSystemMenu EnableMenuItem SendMessageW 3696 4042db SendMessageW 3695->3696 3695->3699 3696->3699 3698 403f7b 18 API calls 3698->3699 3699->3695 3699->3698 3718 4044ce SendMessageW 3699->3718 3719 40653d lstrcpynW 3699->3719 3701 40430a lstrlenW 3702 40657a 17 API calls 3701->3702 3703 404320 SetWindowTextW 3702->3703 3704 401389 2 API calls 3703->3704 3704->3682 3705->3664 3706 40437e CreateDialogParamW 3705->3706 3706->3664 3707 4043b1 3706->3707 3708 404499 18 API calls 3707->3708 3709 4043bc GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3708->3709 3710 401389 2 API calls 3709->3710 3711 404402 3710->3711 3711->3661 3712 40440a ShowWindow 3711->3712 3713 4044e5 SendMessageW 3712->3713 3713->3664 3715 40657a 17 API calls 3714->3715 3716 4044a4 SetDlgItemTextW 3715->3716 3716->3690 3717->3694 3718->3699 3719->3701 3721 404479 3720->3721 3722 40447f SendMessageW 3720->3722 3721->3722 3722->3662 3724 4045c3 3723->3724 3725 404518 GetWindowLongW 3723->3725 3724->3661 3725->3724 3726 40452d 3725->3726 3726->3724 3727 40455a GetSysColor 3726->3727 3728 40455d 3726->3728 3727->3728 3729 404563 SetTextColor 3728->3729 3730 40456d SetBkMode 3728->3730 3729->3730 3731 404585 GetSysColor 3730->3731 3732 40458b 3730->3732 3731->3732 3733 404592 SetBkColor 3732->3733 3734 40459c 3732->3734 3733->3734 3734->3724 3735 4045b6 CreateBrushIndirect 3734->3735 3736 4045af DeleteObject 3734->3736 3735->3724 3736->3735 3737 401b9b 3738 401ba8 3737->3738 3739 401bec 3737->3739 3744 401c31 3738->3744 3745 401bbf 3738->3745 3740 401bf1 3739->3740 3741 401c16 GlobalAlloc 3739->3741 3746 40239d 3740->3746 3756 40653d lstrcpynW 3740->3756 3742 40657a 17 API calls 3741->3742 3742->3744 3743 40657a 17 API calls 3747 402397 3743->3747 3744->3743 3744->3746 3757 40653d lstrcpynW 3745->3757 3752 405b9d MessageBoxIndirectW 3747->3752 3750 401c03 GlobalFree 3750->3746 3751 401bce 3758 40653d lstrcpynW 3751->3758 3752->3746 3754 401bdd 3759 40653d lstrcpynW 3754->3759 3756->3750 3757->3751 3758->3754 3759->3746 4325 40261c 4326 402da6 17 API calls 4325->4326 4327 402623 4326->4327 4330 40602d GetFileAttributesW CreateFileW 4327->4330 4329 40262f 4330->4329 3823 40259e 3824 402de6 17 API calls 3823->3824 3825 4025a8 3824->3825 3826 402d84 17 API calls 3825->3826 3827 4025b1 3826->3827 3828 4025d9 RegEnumValueW 3827->3828 3829 4025cd RegEnumKeyW 3827->3829 3830 40292e 3827->3830 3831 4025f5 RegCloseKey 3828->3831 3832 4025ee 3828->3832 3829->3831 3831->3830 3832->3831 4331 40149e 4332 4014ac PostQuitMessage 4331->4332 4333 40239d 4331->4333 4332->4333 4334 4015a3 4335 402da6 17 API calls 4334->4335 4336 4015aa SetFileAttributesW 4335->4336 4337 4015bc 4336->4337 3191 401fa4 3192 402da6 17 API calls 3191->3192 3193 401faa 3192->3193 3194 40559f 24 API calls 3193->3194 3195 401fb4 3194->3195 3204 405b20 CreateProcessW 3195->3204 3198 40292e 3201 401fcf 3202 401fdd CloseHandle 3201->3202 3212 406484 wsprintfW 3201->3212 3202->3198 3205 405b53 CloseHandle 3204->3205 3206 401fba 3204->3206 3205->3206 3206->3198 3206->3202 3207 4069b5 WaitForSingleObject 3206->3207 3208 4069cf 3207->3208 3209 4069e1 GetExitCodeProcess 3208->3209 3213 406946 3208->3213 3209->3201 3212->3202 3214 406963 PeekMessageW 3213->3214 3215 406973 WaitForSingleObject 3214->3215 3216 406959 DispatchMessageW 3214->3216 3215->3208 3216->3214 3269 40252a 3280 402de6 3269->3280 3272 402da6 17 API calls 3273 40253d 3272->3273 3274 402548 RegQueryValueExW 3273->3274 3279 40292e 3273->3279 3275 40256e RegCloseKey 3274->3275 3276 402568 3274->3276 3275->3279 3276->3275 3285 406484 wsprintfW 3276->3285 3281 402da6 17 API calls 3280->3281 3282 402dfd 3281->3282 3283 4063aa RegOpenKeyExW 3282->3283 3284 402534 3283->3284 3284->3272 3285->3275 4338 40202a 4339 402da6 17 API calls 4338->4339 4340 402031 4339->4340 4341 40690a 5 API calls 4340->4341 4342 402040 4341->4342 4343 40205c GlobalAlloc 4342->4343 4346 4020cc 4342->4346 4344 402070 4343->4344 4343->4346 4345 40690a 5 API calls 4344->4345 4347 402077 4345->4347 4348 40690a 5 API calls 4347->4348 4349 402081 4348->4349 4349->4346 4353 406484 wsprintfW 4349->4353 4351 4020ba 4354 406484 wsprintfW 4351->4354 4353->4351 4354->4346 4355 4021aa 4356 402da6 17 API calls 4355->4356 4357 4021b1 4356->4357 4358 402da6 17 API calls 4357->4358 4359 4021bb 4358->4359 4360 402da6 17 API calls 4359->4360 4361 4021c5 4360->4361 4362 402da6 17 API calls 4361->4362 4363 4021cf 4362->4363 4364 402da6 17 API calls 4363->4364 4365 4021d9 4364->4365 4366 402218 CoCreateInstance 4365->4366 4367 402da6 17 API calls 4365->4367 4370 402237 4366->4370 4367->4366 4368 401423 24 API calls 4369 4022f6 4368->4369 4370->4368 4370->4369 4371 403baa 4372 403bb5 4371->4372 4373 403bb9 4372->4373 4374 403bbc GlobalAlloc 4372->4374 4374->4373 3310 40352d SetErrorMode GetVersionExW 3311 4035b7 3310->3311 3312 40357f GetVersionExW 3310->3312 3313 403610 3311->3313 3314 40690a 5 API calls 3311->3314 3312->3311 3315 40689a 3 API calls 3313->3315 3314->3313 3316 403626 lstrlenA 3315->3316 3316->3313 3317 403636 3316->3317 3318 40690a 5 API calls 3317->3318 3319 40363d 3318->3319 3320 40690a 5 API calls 3319->3320 3321 403644 3320->3321 3322 40690a 5 API calls 3321->3322 3326 403650 #17 OleInitialize SHGetFileInfoW 3322->3326 3325 40369d GetCommandLineW 3401 40653d lstrcpynW 3325->3401 3400 40653d lstrcpynW 3326->3400 3328 4036af 3329 405e39 CharNextW 3328->3329 3330 4036d5 CharNextW 3329->3330 3342 4036e6 3330->3342 3331 4037e4 3332 4037f8 GetTempPathW 3331->3332 3402 4034fc 3332->3402 3334 403810 3336 403814 GetWindowsDirectoryW lstrcatW 3334->3336 3337 40386a DeleteFileW 3334->3337 3335 405e39 CharNextW 3335->3342 3338 4034fc 12 API calls 3336->3338 3412 40307d GetTickCount GetModuleFileNameW 3337->3412 3340 403830 3338->3340 3340->3337 3343 403834 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3340->3343 3341 40387d 3345 403a59 ExitProcess CoUninitialize 3341->3345 3347 403932 3341->3347 3355 405e39 CharNextW 3341->3355 3342->3331 3342->3335 3344 4037e6 3342->3344 3346 4034fc 12 API calls 3343->3346 3496 40653d lstrcpynW 3344->3496 3349 403a69 3345->3349 3350 403a7e 3345->3350 3354 403862 3346->3354 3440 403bec 3347->3440 3501 405b9d 3349->3501 3352 403a86 GetCurrentProcess OpenProcessToken 3350->3352 3353 403afc ExitProcess 3350->3353 3358 403acc 3352->3358 3359 403a9d LookupPrivilegeValueW AdjustTokenPrivileges 3352->3359 3354->3337 3354->3345 3369 40389f 3355->3369 3362 40690a 5 API calls 3358->3362 3359->3358 3360 403941 3360->3345 3365 403ad3 3362->3365 3363 403908 3366 405f14 18 API calls 3363->3366 3364 403949 3368 405b08 5 API calls 3364->3368 3367 403ae8 ExitWindowsEx 3365->3367 3371 403af5 3365->3371 3370 403914 3366->3370 3367->3353 3367->3371 3372 40394e lstrcatW 3368->3372 3369->3363 3369->3364 3370->3345 3497 40653d lstrcpynW 3370->3497 3505 40140b 3371->3505 3373 40396a lstrcatW lstrcmpiW 3372->3373 3374 40395f lstrcatW 3372->3374 3373->3360 3376 40398a 3373->3376 3374->3373 3378 403996 3376->3378 3379 40398f 3376->3379 3382 405aeb 2 API calls 3378->3382 3381 405a6e 4 API calls 3379->3381 3380 403927 3498 40653d lstrcpynW 3380->3498 3384 403994 3381->3384 3385 40399b SetCurrentDirectoryW 3382->3385 3384->3385 3386 4039b8 3385->3386 3387 4039ad 3385->3387 3500 40653d lstrcpynW 3386->3500 3499 40653d lstrcpynW 3387->3499 3390 40657a 17 API calls 3391 4039fa DeleteFileW 3390->3391 3392 403a06 CopyFileW 3391->3392 3397 4039c5 3391->3397 3392->3397 3393 403a50 3395 4062fd 36 API calls 3393->3395 3394 4062fd 36 API calls 3394->3397 3395->3360 3396 40657a 17 API calls 3396->3397 3397->3390 3397->3393 3397->3394 3397->3396 3398 405b20 2 API calls 3397->3398 3399 403a3a CloseHandle 3397->3399 3398->3397 3399->3397 3400->3325 3401->3328 3403 4067c4 5 API calls 3402->3403 3405 403508 3403->3405 3404 403512 3404->3334 3405->3404 3406 405e0c 3 API calls 3405->3406 3407 40351a 3406->3407 3408 405aeb 2 API calls 3407->3408 3409 403520 3408->3409 3508 40605c 3409->3508 3512 40602d GetFileAttributesW CreateFileW 3412->3512 3414 4030bd 3432 4030cd 3414->3432 3513 40653d lstrcpynW 3414->3513 3416 4030e3 3417 405e58 2 API calls 3416->3417 3418 4030e9 3417->3418 3514 40653d lstrcpynW 3418->3514 3420 4030f4 GetFileSize 3421 4031ee 3420->3421 3439 40310b 3420->3439 3515 403019 3421->3515 3423 4031f7 3425 403227 GlobalAlloc 3423->3425 3423->3432 3527 4034e5 SetFilePointer 3423->3527 3424 4034cf ReadFile 3424->3439 3526 4034e5 SetFilePointer 3425->3526 3427 40325a 3429 403019 6 API calls 3427->3429 3429->3432 3430 403210 3433 4034cf ReadFile 3430->3433 3431 403242 3434 4032b4 31 API calls 3431->3434 3432->3341 3435 40321b 3433->3435 3437 40324e 3434->3437 3435->3425 3435->3432 3436 403019 6 API calls 3436->3439 3437->3432 3437->3437 3438 40328b SetFilePointer 3437->3438 3438->3432 3439->3421 3439->3424 3439->3427 3439->3432 3439->3436 3441 40690a 5 API calls 3440->3441 3442 403c00 3441->3442 3443 403c06 3442->3443 3444 403c18 3442->3444 3543 406484 wsprintfW 3443->3543 3445 40640b 3 API calls 3444->3445 3446 403c48 3445->3446 3448 403c67 lstrcatW 3446->3448 3450 40640b 3 API calls 3446->3450 3449 403c16 3448->3449 3528 403ec2 3449->3528 3450->3448 3453 405f14 18 API calls 3454 403c99 3453->3454 3455 403d2d 3454->3455 3457 40640b 3 API calls 3454->3457 3456 405f14 18 API calls 3455->3456 3458 403d33 3456->3458 3459 403ccb 3457->3459 3460 403d43 LoadImageW 3458->3460 3461 40657a 17 API calls 3458->3461 3459->3455 3464 403cec lstrlenW 3459->3464 3467 405e39 CharNextW 3459->3467 3462 403de9 3460->3462 3463 403d6a RegisterClassW 3460->3463 3461->3460 3466 40140b 2 API calls 3462->3466 3465 403da0 SystemParametersInfoW CreateWindowExW 3463->3465 3495 403df3 3463->3495 3468 403d20 3464->3468 3469 403cfa lstrcmpiW 3464->3469 3465->3462 3473 403def 3466->3473 3471 403ce9 3467->3471 3470 405e0c 3 API calls 3468->3470 3469->3468 3472 403d0a GetFileAttributesW 3469->3472 3475 403d26 3470->3475 3471->3464 3476 403d16 3472->3476 3474 403ec2 18 API calls 3473->3474 3473->3495 3477 403e00 3474->3477 3544 40653d lstrcpynW 3475->3544 3476->3468 3479 405e58 2 API calls 3476->3479 3480 403e0c ShowWindow 3477->3480 3481 403e8f 3477->3481 3479->3468 3483 40689a 3 API calls 3480->3483 3536 405672 OleInitialize 3481->3536 3485 403e24 3483->3485 3484 403e95 3486 403eb1 3484->3486 3487 403e99 3484->3487 3488 403e32 GetClassInfoW 3485->3488 3490 40689a 3 API calls 3485->3490 3489 40140b 2 API calls 3486->3489 3493 40140b 2 API calls 3487->3493 3487->3495 3491 403e46 GetClassInfoW RegisterClassW 3488->3491 3492 403e5c DialogBoxParamW 3488->3492 3489->3495 3490->3488 3491->3492 3494 40140b 2 API calls 3492->3494 3493->3495 3494->3495 3495->3360 3496->3332 3497->3380 3498->3347 3499->3386 3500->3397 3502 405bb2 3501->3502 3503 403a76 ExitProcess 3502->3503 3504 405bc6 MessageBoxIndirectW 3502->3504 3504->3503 3506 401389 2 API calls 3505->3506 3507 401420 3506->3507 3507->3353 3509 406069 GetTickCount GetTempFileNameW 3508->3509 3510 40352b 3509->3510 3511 40609f 3509->3511 3510->3334 3511->3509 3511->3510 3512->3414 3513->3416 3514->3420 3516 403022 3515->3516 3517 40303a 3515->3517 3518 403032 3516->3518 3519 40302b DestroyWindow 3516->3519 3520 403042 3517->3520 3521 40304a GetTickCount 3517->3521 3518->3423 3519->3518 3522 406946 2 API calls 3520->3522 3523 403058 CreateDialogParamW ShowWindow 3521->3523 3524 40307b 3521->3524 3525 403048 3522->3525 3523->3524 3524->3423 3525->3423 3526->3431 3527->3430 3529 403ed6 3528->3529 3545 406484 wsprintfW 3529->3545 3531 403f47 3546 403f7b 3531->3546 3533 403c77 3533->3453 3534 403f4c 3534->3533 3535 40657a 17 API calls 3534->3535 3535->3534 3549 4044e5 3536->3549 3538 405695 3542 4056bc 3538->3542 3552 401389 3538->3552 3539 4044e5 SendMessageW 3540 4056ce OleUninitialize 3539->3540 3540->3484 3542->3539 3543->3449 3544->3455 3545->3531 3547 40657a 17 API calls 3546->3547 3548 403f89 SetWindowTextW 3547->3548 3548->3534 3550 4044fd 3549->3550 3551 4044ee SendMessageW 3549->3551 3550->3538 3551->3550 3554 401390 3552->3554 3553 4013fe 3553->3538 3554->3553 3555 4013cb MulDiv SendMessageW 3554->3555 3555->3554 4375 401a30 4376 402da6 17 API calls 4375->4376 4377 401a39 ExpandEnvironmentStringsW 4376->4377 4378 401a4d 4377->4378 4380 401a60 4377->4380 4379 401a52 lstrcmpW 4378->4379 4378->4380 4379->4380 4386 4023b2 4387 4023c0 4386->4387 4388 4023ba 4386->4388 4390 4023ce 4387->4390 4391 402da6 17 API calls 4387->4391 4389 402da6 17 API calls 4388->4389 4389->4387 4392 402da6 17 API calls 4390->4392 4394 4023dc 4390->4394 4391->4390 4392->4394 4393 402da6 17 API calls 4395 4023e5 WritePrivateProfileStringW 4393->4395 4394->4393 4396 402434 4397 402467 4396->4397 4398 40243c 4396->4398 4399 402da6 17 API calls 4397->4399 4400 402de6 17 API calls 4398->4400 4401 40246e 4399->4401 4402 402443 4400->4402 4407 402e64 4401->4407 4404 402da6 17 API calls 4402->4404 4405 40247b 4402->4405 4406 402454 RegDeleteValueW RegCloseKey 4404->4406 4406->4405 4408 402e71 4407->4408 4409 402e78 4407->4409 4408->4405 4409->4408 4411 402ea9 4409->4411 4412 4063aa RegOpenKeyExW 4411->4412 4413 402ed7 4412->4413 4414 402ee7 RegEnumValueW 4413->4414 4415 402f0a 4413->4415 4422 402f81 4413->4422 4414->4415 4416 402f71 RegCloseKey 4414->4416 4415->4416 4417 402f46 RegEnumKeyW 4415->4417 4418 402f4f RegCloseKey 4415->4418 4421 402ea9 6 API calls 4415->4421 4416->4422 4417->4415 4417->4418 4419 40690a 5 API calls 4418->4419 4420 402f5f 4419->4420 4420->4422 4423 402f63 RegDeleteKeyW 4420->4423 4421->4415 4422->4408 4423->4422 4424 401735 4425 402da6 17 API calls 4424->4425 4426 40173c SearchPathW 4425->4426 4427 401757 4426->4427 4428 401d38 4429 402d84 17 API calls 4428->4429 4430 401d3f 4429->4430 4431 402d84 17 API calls 4430->4431 4432 401d4b GetDlgItem 4431->4432 4433 402638 4432->4433 4434 4014b8 4435 4014be 4434->4435 4436 401389 2 API calls 4435->4436 4437 4014c6 4436->4437 4438 40263e 4439 402652 4438->4439 4440 40266d 4438->4440 4441 402d84 17 API calls 4439->4441 4442 402672 4440->4442 4443 40269d 4440->4443 4450 402659 4441->4450 4444 402da6 17 API calls 4442->4444 4445 402da6 17 API calls 4443->4445 4447 402679 4444->4447 4446 4026a4 lstrlenW 4445->4446 4446->4450 4455 40655f WideCharToMultiByte 4447->4455 4449 40268d lstrlenA 4449->4450 4451 4026d1 4450->4451 4452 4026e7 4450->4452 4454 40610e 5 API calls 4450->4454 4451->4452 4453 4060df WriteFile 4451->4453 4453->4452 4454->4451 4455->4449

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 0040352D Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 0 40352d-40357d SetErrorMode GetVersionExW 1 4035b7-4035be 0->1 2 40357f-4035b3 GetVersionExW 0->2 3 4035c0 1->3 4 4035c8-403608 1->4 2->1 3->4 5 40360a-403612 call 40690a 4->5 6 40361b 4->6 5->6 11 403614 5->11 8 403620-403634 call 40689a lstrlenA 6->8 13 403636-403652 call 40690a * 3 8->13 11->6 20 403663-4036c5 #17 OleInitialize SHGetFileInfoW call 40653d GetCommandLineW call 40653d 13->20 21 403654-40365a 13->21 28 4036c7-4036c9 20->28 29 4036ce-4036e1 call 405e39 CharNextW 20->29 21->20 25 40365c 21->25 25->20 28->29 32 4037d8-4037de 29->32 33 4037e4 32->33 34 4036e6-4036ec 32->34 37 4037f8-403812 GetTempPathW call 4034fc 33->37 35 4036f5-4036fb 34->35 36 4036ee-4036f3 34->36 38 403702-403706 35->38 39 4036fd-403701 35->39 36->35 36->36 47 403814-403832 GetWindowsDirectoryW lstrcatW call 4034fc 37->47 48 40386a-403882 DeleteFileW call 40307d 37->48 41 4037c6-4037d4 call 405e39 38->41 42 40370c-403712 38->42 39->38 41->32 59 4037d6-4037d7 41->59 45 403714-40371b 42->45 46 40372c-403765 42->46 52 403722 45->52 53 40371d-403720 45->53 54 403781-4037bb 46->54 55 403767-40376c 46->55 47->48 62 403834-403864 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034fc 47->62 64 403888-40388e 48->64 65 403a59-403a67 ExitProcess CoUninitialize 48->65 52->46 53->46 53->52 57 4037c3-4037c5 54->57 58 4037bd-4037c1 54->58 55->54 61 40376e-403776 55->61 57->41 58->57 63 4037e6-4037f3 call 40653d 58->63 59->32 66 403778-40377b 61->66 67 40377d 61->67 62->48 62->65 63->37 69 403894-4038a7 call 405e39 64->69 70 403935-40393c call 403bec 64->70 72 403a69-403a78 call 405b9d ExitProcess 65->72 73 403a7e-403a84 65->73 66->54 66->67 67->54 88 4038f9-403906 69->88 89 4038a9-4038de 69->89 84 403941-403944 70->84 75 403a86-403a9b GetCurrentProcess OpenProcessToken 73->75 76 403afc-403b04 73->76 81 403acc-403ada call 40690a 75->81 82 403a9d-403ac6 LookupPrivilegeValueW AdjustTokenPrivileges 75->82 85 403b06 76->85 86 403b09-403b0c ExitProcess 76->86 95 403ae8-403af3 ExitWindowsEx 81->95 96 403adc-403ae6 81->96 82->81 84->65 85->86 90 403908-403916 call 405f14 88->90 91 403949-40395d call 405b08 lstrcatW 88->91 93 4038e0-4038e4 89->93 90->65 106 40391c-403932 call 40653d * 2 90->106 104 40396a-403984 lstrcatW lstrcmpiW 91->104 105 40395f-403965 lstrcatW 91->105 98 4038e6-4038eb 93->98 99 4038ed-4038f5 93->99 95->76 102 403af5-403af7 call 40140b 95->102 96->95 96->102 98->99 100 4038f7 98->100 99->93 99->100 100->88 102->76 109 403a57 104->109 110 40398a-40398d 104->110 105->104 106->70 109->65 112 403996 call 405aeb 110->112 113 40398f-403994 call 405a6e 110->113 119 40399b-4039ab SetCurrentDirectoryW 112->119 113->119 121 4039b8-4039e4 call 40653d 119->121 122 4039ad-4039b3 call 40653d 119->122 126 4039e9-403a04 call 40657a DeleteFileW 121->126 122->121 129 403a44-403a4e 126->129 130 403a06-403a16 CopyFileW 126->130 129->126 132 403a50-403a52 call 4062fd 129->132 130->129 131 403a18-403a38 call 4062fd call 40657a call 405b20 130->131 131->129 140 403a3a-403a41 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008001), ref: 00403550
                                                                                                                                                                                      • GetVersionExW.KERNEL32(?), ref: 00403579
                                                                                                                                                                                      • GetVersionExW.KERNEL32(0000011C), ref: 00403590
                                                                                                                                                                                      • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
                                                                                                                                                                                      • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
                                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 0040366A
                                                                                                                                                                                      • SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
                                                                                                                                                                                      • GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
                                                                                                                                                                                      • CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
                                                                                                                                                                                      • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
                                                                                                                                                                                      • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
                                                                                                                                                                                      • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
                                                                                                                                                                                      • DeleteFileW.KERNEL32(1033), ref: 0040386F
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403956
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403965
                                                                                                                                                                                        • Part of subcall function 00405AEB: CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 00403970
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
                                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
                                                                                                                                                                                      • DeleteFileW.KERNEL32(0042AA28,0042AA28,?,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,?), ref: 004039FB
                                                                                                                                                                                      • CopyFileW.KERNEL32(C:\Users\user\Desktop\Setup.exe,0042AA28,00000001), ref: 00403A0E
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
                                                                                                                                                                                      • ExitProcess.KERNEL32(?), ref: 00403A59
                                                                                                                                                                                      • CoUninitialize.COMBASE(?), ref: 00403A5E
                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403A78
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
                                                                                                                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403B0C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                      • String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsq4808.tmp$C:\Users\user\Desktop\Setup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                      • API String ID: 2292928366-274301122
                                                                                                                                                                                      • Opcode ID: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                      • Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
                                                                                                                                                                                      • Opcode Fuzzy Hash: a9950f16e1a4a62c6ded3d55c7a98e4382dcb346a085109a7b13f69721f27fd6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D
                                                                                                                                                                                      Function 004056DE Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 141 4056de-4056f9 142 405888-40588f 141->142 143 4056ff-4057c6 GetDlgItem * 3 call 4044ce call 404e27 GetClientRect GetSystemMetrics SendMessageW * 2 141->143 145 405891-4058b3 GetDlgItem CreateThread CloseHandle 142->145 146 4058b9-4058c6 142->146 165 4057e4-4057e7 143->165 166 4057c8-4057e2 SendMessageW * 2 143->166 145->146 148 4058e4-4058ee 146->148 149 4058c8-4058ce 146->149 150 4058f0-4058f6 148->150 151 405944-405948 148->151 153 4058d0-4058df ShowWindow * 2 call 4044ce 149->153 154 405909-405912 call 404500 149->154 155 4058f8-405904 call 404472 150->155 156 40591e-40592e ShowWindow 150->156 151->154 159 40594a-405950 151->159 153->148 162 405917-40591b 154->162 155->154 163 405930-405939 call 40559f 156->163 164 40593e-40593f call 404472 156->164 159->154 167 405952-405965 SendMessageW 159->167 163->164 164->151 170 4057f7-40580e call 404499 165->170 171 4057e9-4057f5 SendMessageW 165->171 166->165 172 405a67-405a69 167->172 173 40596b-405996 CreatePopupMenu call 40657a AppendMenuW 167->173 180 405810-405824 ShowWindow 170->180 181 405844-405865 GetDlgItem SendMessageW 170->181 171->170 172->162 178 405998-4059a8 GetWindowRect 173->178 179 4059ab-4059c0 TrackPopupMenu 173->179 178->179 179->172 182 4059c6-4059dd 179->182 183 405833 180->183 184 405826-405831 ShowWindow 180->184 181->172 185 40586b-405883 SendMessageW * 2 181->185 186 4059e2-4059fd SendMessageW 182->186 187 405839-40583f call 4044ce 183->187 184->187 185->172 186->186 188 4059ff-405a22 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 186->188 187->181 190 405a24-405a4b SendMessageW 188->190 190->190 191 405a4d-405a61 GlobalUnlock SetClipboardData CloseClipboard 190->191 191->172
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000403), ref: 0040573C
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EE), ref: 0040574B
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00405788
                                                                                                                                                                                      • GetSystemMetrics.USER32(00000002), ref: 0040578F
                                                                                                                                                                                      • SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
                                                                                                                                                                                      • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
                                                                                                                                                                                      • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
                                                                                                                                                                                      • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
                                                                                                                                                                                      • SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
                                                                                                                                                                                      • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
                                                                                                                                                                                      • ShowWindow.USER32(?,00000008), ref: 0040582B
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EC), ref: 0040584C
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003F8), ref: 0040575A
                                                                                                                                                                                        • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EC), ref: 0040589E
                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 004058B3
                                                                                                                                                                                      • ShowWindow.USER32(00000000), ref: 004058D7
                                                                                                                                                                                      • ShowWindow.USER32(00030494,00000008), ref: 004058DC
                                                                                                                                                                                      • ShowWindow.USER32(00000008), ref: 00405926
                                                                                                                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
                                                                                                                                                                                      • CreatePopupMenu.USER32 ref: 0040596B
                                                                                                                                                                                      • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
                                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 0040599F
                                                                                                                                                                                      • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
                                                                                                                                                                                      • SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00405A00
                                                                                                                                                                                      • EmptyClipboard.USER32 ref: 00405A06
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00405A1C
                                                                                                                                                                                      • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 00405A50
                                                                                                                                                                                      • SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
                                                                                                                                                                                      • CloseClipboard.USER32 ref: 00405A61
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                      • String ID: liy${
                                                                                                                                                                                      • API String ID: 590372296-2983317269
                                                                                                                                                                                      • Opcode ID: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                      • Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
                                                                                                                                                                                      • Opcode Fuzzy Hash: c8ef7bbbe888f33c7642292c9829dc0fe895fcac448e4408b73d3b9779d96911
                                                                                                                                                                                      • Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58
                                                                                                                                                                                      Function 00405C49 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 148filestringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 498 405c49-405c6f call 405f14 501 405c71-405c83 DeleteFileW 498->501 502 405c88-405c8f 498->502 503 405e05-405e09 501->503 504 405c91-405c93 502->504 505 405ca2-405cb2 call 40653d 502->505 506 405db3-405db8 504->506 507 405c99-405c9c 504->507 513 405cc1-405cc2 call 405e58 505->513 514 405cb4-405cbf lstrcatW 505->514 506->503 509 405dba-405dbd 506->509 507->505 507->506 511 405dc7-405dcf call 406873 509->511 512 405dbf-405dc5 509->512 511->503 522 405dd1-405de5 call 405e0c call 405c01 511->522 512->503 516 405cc7-405ccb 513->516 514->516 518 405cd7-405cdd lstrcatW 516->518 519 405ccd-405cd5 516->519 521 405ce2-405cfe lstrlenW FindFirstFileW 518->521 519->518 519->521 523 405d04-405d0c 521->523 524 405da8-405dac 521->524 538 405de7-405dea 522->538 539 405dfd-405e00 call 40559f 522->539 526 405d2c-405d40 call 40653d 523->526 527 405d0e-405d16 523->527 524->506 529 405dae 524->529 540 405d42-405d4a 526->540 541 405d57-405d62 call 405c01 526->541 530 405d18-405d20 527->530 531 405d8b-405d9b FindNextFileW 527->531 529->506 530->526 534 405d22-405d2a 530->534 531->523 537 405da1-405da2 FindClose 531->537 534->526 534->531 537->524 538->512 544 405dec-405dfb call 40559f call 4062fd 538->544 539->503 540->531 545 405d4c-405d55 call 405c49 540->545 549 405d83-405d86 call 40559f 541->549 550 405d64-405d67 541->550 544->503 545->531 549->531 553 405d69-405d79 call 40559f call 4062fd 550->553 554 405d7b-405d81 550->554 553->531 554->531
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBA
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CDD
                                                                                                                                                                                      • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
                                                                                                                                                                                      • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
                                                                                                                                                                                      • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00405DA2
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                      • String ID: .$.$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsi277F.tmp\*.*$\*.*
                                                                                                                                                                                      • API String ID: 2035342205-1109085579
                                                                                                                                                                                      • Opcode ID: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                      • Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
                                                                                                                                                                                      • Opcode Fuzzy Hash: d4824498ca5d4646401654330336f54dc3516ea2401a274e156101c2699109e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE
                                                                                                                                                                                      Function 00406873 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindFirstFileW.KERNEL32(74DF3420,004302B8,C:\,00405F5D,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 0040688A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                      • String ID: C:\
                                                                                                                                                                                      • API String ID: 2295610775-3404278061
                                                                                                                                                                                      • Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                      • Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
                                                                                                                                                                                      • Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD
                                                                                                                                                                                      Function 00403F9A Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 192 403f9a-403fac 193 403fb2-403fb8 192->193 194 404113-404122 192->194 193->194 195 403fbe-403fc7 193->195 196 404171-404186 194->196 197 404124-40416c GetDlgItem * 2 call 404499 SetClassLongW call 40140b 194->197 200 403fc9-403fd6 SetWindowPos 195->200 201 403fdc-403fe3 195->201 198 4041c6-4041cb call 4044e5 196->198 199 404188-40418b 196->199 197->196 214 4041d0-4041eb 198->214 203 40418d-404198 call 401389 199->203 204 4041be-4041c0 199->204 200->201 206 403fe5-403fff ShowWindow 201->206 207 404027-40402d 201->207 203->204 228 40419a-4041b9 SendMessageW 203->228 204->198 213 404466 204->213 215 404100-40410e call 404500 206->215 216 404005-404018 GetWindowLongW 206->216 209 404046-404049 207->209 210 40402f-404041 DestroyWindow 207->210 220 40404b-404057 SetWindowLongW 209->220 221 40405c-404062 209->221 217 404443-404449 210->217 219 404468-40446f 213->219 224 4041f4-4041fa 214->224 225 4041ed-4041ef call 40140b 214->225 215->219 216->215 226 40401e-404021 ShowWindow 216->226 217->213 231 40444b-404451 217->231 220->219 221->215 227 404068-404077 GetDlgItem 221->227 232 404200-40420b 224->232 233 404424-40443d DestroyWindow KiUserCallbackDispatcher 224->233 225->224 226->207 235 404096-404099 227->235 236 404079-404090 SendMessageW IsWindowEnabled 227->236 228->219 231->213 237 404453-40445c ShowWindow 231->237 232->233 234 404211-40425e call 40657a call 404499 * 3 GetDlgItem 232->234 233->217 264 404260-404265 234->264 265 404268-4042a4 ShowWindow KiUserCallbackDispatcher call 4044bb KiUserCallbackDispatcher 234->265 239 40409b-40409c 235->239 240 40409e-4040a1 235->240 236->213 236->235 237->213 242 4040cc-4040d1 call 404472 239->242 243 4040a3-4040a9 240->243 244 4040af-4040b4 240->244 242->215 247 4040ea-4040fa SendMessageW 243->247 248 4040ab-4040ad 243->248 244->247 249 4040b6-4040bc 244->249 247->215 248->242 252 4040d3-4040dc call 40140b 249->252 253 4040be-4040c4 call 40140b 249->253 252->215 262 4040de-4040e8 252->262 260 4040ca 253->260 260->242 262->260 264->265 268 4042a6-4042a7 265->268 269 4042a9 265->269 270 4042ab-4042d9 GetSystemMenu EnableMenuItem SendMessageW 268->270 269->270 271 4042db-4042ec SendMessageW 270->271 272 4042ee 270->272 273 4042f4-404333 call 4044ce call 403f7b call 40653d lstrlenW call 40657a SetWindowTextW call 401389 271->273 272->273 273->214 284 404339-40433b 273->284 284->214 285 404341-404345 284->285 286 404364-404378 DestroyWindow 285->286 287 404347-40434d 285->287 286->217 289 40437e-4043ab CreateDialogParamW 286->289 287->213 288 404353-404359 287->288 288->214 290 40435f 288->290 289->217 291 4043b1-404408 call 404499 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 289->291 290->213 291->213 296 40440a-40441d ShowWindow call 4044e5 291->296 298 404422 296->298 298->217
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
                                                                                                                                                                                      • ShowWindow.USER32(?), ref: 00403FF6
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00404008
                                                                                                                                                                                      • ShowWindow.USER32(?,00000004), ref: 00404021
                                                                                                                                                                                      • DestroyWindow.USER32 ref: 00404035
                                                                                                                                                                                      • SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
                                                                                                                                                                                      • GetDlgItem.USER32(?,?), ref: 0040406D
                                                                                                                                                                                      • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
                                                                                                                                                                                      • IsWindowEnabled.USER32(00000000), ref: 00404088
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000001), ref: 00404133
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000002), ref: 0040413D
                                                                                                                                                                                      • SetClassLongW.USER32(?,000000F2,?), ref: 00404157
                                                                                                                                                                                      • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000003), ref: 0040424E
                                                                                                                                                                                      • ShowWindow.USER32(00000000,?), ref: 0040426F
                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040429C
                                                                                                                                                                                      • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
                                                                                                                                                                                      • EnableMenuItem.USER32(00000000), ref: 004042B9
                                                                                                                                                                                      • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
                                                                                                                                                                                      • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
                                                                                                                                                                                      • lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
                                                                                                                                                                                      • SetWindowTextW.USER32(?,0042D268), ref: 00404322
                                                                                                                                                                                      • ShowWindow.USER32(?,0000000A), ref: 00404456
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                                                                                                                      • String ID: liy
                                                                                                                                                                                      • API String ID: 3964124867-594211360
                                                                                                                                                                                      • Opcode ID: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                      • Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
                                                                                                                                                                                      • Opcode Fuzzy Hash: e7f11a10533a611f3fe78e549378f399a66bd747c21cf404ab37e5123baac86e
                                                                                                                                                                                      • Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D
                                                                                                                                                                                      Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 299 403bec-403c04 call 40690a 302 403c06-403c16 call 406484 299->302 303 403c18-403c4f call 40640b 299->303 312 403c72-403c9b call 403ec2 call 405f14 302->312 308 403c51-403c62 call 40640b 303->308 309 403c67-403c6d lstrcatW 303->309 308->309 309->312 317 403ca1-403ca6 312->317 318 403d2d-403d35 call 405f14 312->318 317->318 319 403cac-403cd4 call 40640b 317->319 324 403d43-403d68 LoadImageW 318->324 325 403d37-403d3e call 40657a 318->325 319->318 326 403cd6-403cda 319->326 328 403de9-403df1 call 40140b 324->328 329 403d6a-403d9a RegisterClassW 324->329 325->324 330 403cec-403cf8 lstrlenW 326->330 331 403cdc-403ce9 call 405e39 326->331 343 403df3-403df6 328->343 344 403dfb-403e06 call 403ec2 328->344 332 403da0-403de4 SystemParametersInfoW CreateWindowExW 329->332 333 403eb8 329->333 337 403d20-403d28 call 405e0c call 40653d 330->337 338 403cfa-403d08 lstrcmpiW 330->338 331->330 332->328 336 403eba-403ec1 333->336 337->318 338->337 342 403d0a-403d14 GetFileAttributesW 338->342 347 403d16-403d18 342->347 348 403d1a-403d1b call 405e58 342->348 343->336 352 403e0c-403e26 ShowWindow call 40689a 344->352 353 403e8f-403e90 call 405672 344->353 347->337 347->348 348->337 360 403e32-403e44 GetClassInfoW 352->360 361 403e28-403e2d call 40689a 352->361 356 403e95-403e97 353->356 358 403eb1-403eb3 call 40140b 356->358 359 403e99-403e9f 356->359 358->333 359->343 362 403ea5-403eac call 40140b 359->362 365 403e46-403e56 GetClassInfoW RegisterClassW 360->365 366 403e5c-403e7f DialogBoxParamW call 40140b 360->366 361->360 362->343 365->366 370 403e84-403e8d call 403b3c 366->370 370->336
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                        • Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                      • lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403C6D
                                                                                                                                                                                      • lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 00403CED
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(Remove folder: ,?,00000000,?), ref: 00403D0B
                                                                                                                                                                                      • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54
                                                                                                                                                                                        • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                      • RegisterClassW.USER32(00433EA0), ref: 00403D91
                                                                                                                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
                                                                                                                                                                                      • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
                                                                                                                                                                                      • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
                                                                                                                                                                                      • RegisterClassW.USER32(00433EA0), ref: 00403E56
                                                                                                                                                                                      • DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                      • API String ID: 1975747703-1389134667
                                                                                                                                                                                      • Opcode ID: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                      • Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
                                                                                                                                                                                      • Opcode Fuzzy Hash: b5e4680adf6fab30abf8c31c9b96982c96c1f128c8b6e65fe06ccfbd791f05a2
                                                                                                                                                                                      • Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D
                                                                                                                                                                                      Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181memoryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 373 40307d-4030cb GetTickCount GetModuleFileNameW call 40602d 376 4030d7-403105 call 40653d call 405e58 call 40653d GetFileSize 373->376 377 4030cd-4030d2 373->377 385 4031f0-4031fe call 403019 376->385 386 40310b 376->386 378 4032ad-4032b1 377->378 392 403200-403203 385->392 393 403253-403258 385->393 388 403110-403127 386->388 390 403129 388->390 391 40312b-403134 call 4034cf 388->391 390->391 399 40325a-403262 call 403019 391->399 400 40313a-403141 391->400 395 403205-40321d call 4034e5 call 4034cf 392->395 396 403227-403251 GlobalAlloc call 4034e5 call 4032b4 392->396 393->378 395->393 419 40321f-403225 395->419 396->393 424 403264-403275 396->424 399->393 404 403143-403157 call 405fe8 400->404 405 4031bd-4031c1 400->405 410 4031cb-4031d1 404->410 422 403159-403160 404->422 409 4031c3-4031ca call 403019 405->409 405->410 409->410 415 4031e0-4031e8 410->415 416 4031d3-4031dd call 4069f7 410->416 415->388 423 4031ee 415->423 416->415 419->393 419->396 422->410 428 403162-403169 422->428 423->385 425 403277 424->425 426 40327d-403282 424->426 425->426 429 403283-403289 426->429 428->410 430 40316b-403172 428->430 429->429 431 40328b-4032a6 SetFilePointer call 405fe8 429->431 430->410 432 403174-40317b 430->432 436 4032ab 431->436 432->410 433 40317d-40319d 432->433 433->393 435 4031a3-4031a7 433->435 437 4031a9-4031ad 435->437 438 4031af-4031b7 435->438 436->378 437->423 437->438 438->410 439 4031b9-4031bb 438->439 439->410
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040308E
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA
                                                                                                                                                                                        • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                        • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\Setup.exe,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\Setup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
                                                                                                                                                                                      • API String ID: 2803837635-3037081627
                                                                                                                                                                                      • Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                      • Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
                                                                                                                                                                                      • Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D
                                                                                                                                                                                      Function 0040657A Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 196stringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 440 40657a-406585 441 406587-406596 440->441 442 406598-4065ae 440->442 441->442 443 4065b0-4065bd 442->443 444 4065c6-4065cf 442->444 443->444 445 4065bf-4065c2 443->445 446 4065d5 444->446 447 4067aa-4067b5 444->447 445->444 448 4065da-4065e7 446->448 449 4067c0-4067c1 447->449 450 4067b7-4067bb call 40653d 447->450 448->447 451 4065ed-4065f6 448->451 450->449 453 406788 451->453 454 4065fc-406639 451->454 457 406796-406799 453->457 458 40678a-406794 453->458 455 40672c-406731 454->455 456 40663f-406646 454->456 462 406733-406739 455->462 463 406764-406769 455->463 459 406648-40664a 456->459 460 40664b-40664d 456->460 461 40679b-4067a4 457->461 458->461 459->460 464 40668a-40668d 460->464 465 40664f-406676 call 40640b 460->465 461->447 468 4065d7 461->468 469 406749-406755 call 40653d 462->469 470 40673b-406747 call 406484 462->470 466 406778-406786 lstrlenW 463->466 467 40676b-406773 call 40657a 463->467 474 40669d-4066a0 464->474 475 40668f-40669b GetSystemDirectoryW 464->475 485 406713-406717 465->485 486 40667c-406685 call 40657a 465->486 466->461 467->466 468->448 478 40675a-406760 469->478 470->478 481 4066a2-4066b0 GetWindowsDirectoryW 474->481 482 406709-40670b 474->482 480 40670d-406711 475->480 478->466 483 406762 478->483 480->485 487 406724-40672a call 4067c4 480->487 481->482 482->480 484 4066b2-4066ba 482->484 483->487 491 4066d1-4066e7 SHGetSpecialFolderLocation 484->491 492 4066bc-4066c5 484->492 485->487 488 406719-40671f lstrcatW 485->488 486->480 487->466 488->487 493 406705 491->493 494 4066e9-406703 SHGetPathFromIDListW CoTaskMemFree 491->494 497 4066cd-4066cf 492->497 493->482 494->480 494->493 497->480 497->491
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 00406695
                                                                                                                                                                                      • GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00000000,00424420,74DF23A0), ref: 004066A8
                                                                                                                                                                                      • lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                      • lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000), ref: 00406779
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsq4808.tmp$Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                      • API String ID: 4260037668-3518682730
                                                                                                                                                                                      • Opcode ID: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                      • Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
                                                                                                                                                                                      • Opcode Fuzzy Hash: 71c82525ba0a65243e1f04eb87fe478d36a31e86dfe70ef8bf5ce9ddd18f012c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D
                                                                                                                                                                                      Function 004032B4 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 166COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 562 4032b4-4032cb 563 4032d4-4032dd 562->563 564 4032cd 562->564 565 4032e6-4032eb 563->565 566 4032df 563->566 564->563 567 4032fb-403308 call 4034cf 565->567 568 4032ed-4032f6 call 4034e5 565->568 566->565 572 4034bd 567->572 573 40330e-403312 567->573 568->567 574 4034bf-4034c0 572->574 575 403468-40346a 573->575 576 403318-403361 GetTickCount 573->576 579 4034c8-4034cc 574->579 577 4034aa-4034ad 575->577 578 40346c-40346f 575->578 580 4034c5 576->580 581 403367-40336f 576->581 585 4034b2-4034bb call 4034cf 577->585 586 4034af 577->586 578->580 582 403471 578->582 580->579 583 403371 581->583 584 403374-403382 call 4034cf 581->584 588 403474-40347a 582->588 583->584 584->572 596 403388-403391 584->596 585->572 594 4034c2 585->594 586->585 591 40347c 588->591 592 40347e-40348c call 4034cf 588->592 591->592 592->572 599 40348e-40349a call 4060df 592->599 594->580 598 403397-4033b7 call 406a65 596->598 604 403460-403462 598->604 605 4033bd-4033d0 GetTickCount 598->605 606 403464-403466 599->606 607 40349c-4034a6 599->607 604->574 608 4033d2-4033da 605->608 609 40341b-40341d 605->609 606->574 607->588 614 4034a8 607->614 610 4033e2-403418 MulDiv wsprintfW call 40559f 608->610 611 4033dc-4033e0 608->611 612 403454-403458 609->612 613 40341f-403423 609->613 610->609 611->609 611->610 612->581 618 40345e 612->618 616 403425-40342c call 4060df 613->616 617 40343a-403445 613->617 614->580 622 403431-403433 616->622 621 403448-40344c 617->621 618->580 621->598 623 403452 621->623 622->606 624 403435-403438 622->624 623->580 624->621
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CountTick$wsprintf
                                                                                                                                                                                      • String ID: *B$ DB$ A$ A$... %d%%$tClientRect$}8@
                                                                                                                                                                                      • API String ID: 551687249-400812307
                                                                                                                                                                                      • Opcode ID: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                      • Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3bb00b159343602b5baf8216f2e6fd7ccfc314744640e4b330e170589aabe739
                                                                                                                                                                                      • Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9
                                                                                                                                                                                      Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 625 40176f-401794 call 402da6 call 405e83 630 401796-40179c call 40653d 625->630 631 40179e-4017b0 call 40653d call 405e0c lstrcatW 625->631 636 4017b5-4017b6 call 4067c4 630->636 631->636 640 4017bb-4017bf 636->640 641 4017c1-4017cb call 406873 640->641 642 4017f2-4017f5 640->642 649 4017dd-4017ef 641->649 650 4017cd-4017db CompareFileTime 641->650 643 4017f7-4017f8 call 406008 642->643 644 4017fd-401819 call 40602d 642->644 643->644 652 40181b-40181e 644->652 653 40188d-4018b6 call 40559f call 4032b4 644->653 649->642 650->649 654 401820-40185e call 40653d * 2 call 40657a call 40653d call 405b9d 652->654 655 40186f-401879 call 40559f 652->655 665 4018b8-4018bc 653->665 666 4018be-4018ca SetFileTime 653->666 654->640 687 401864-401865 654->687 667 401882-401888 655->667 665->666 669 4018d0-4018db CloseHandle 665->669 666->669 670 402c33 667->670 673 4018e1-4018e4 669->673 674 402c2a-402c2d 669->674 675 402c35-402c39 670->675 677 4018e6-4018f7 call 40657a lstrcatW 673->677 678 4018f9-4018fc call 40657a 673->678 674->670 684 401901-4023a2 call 405b9d 677->684 678->684 684->674 684->675 687->667 689 401867-401868 687->689 689->655
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrcatW.KERNEL32(00000000,00000000,get,00441000,?,?,00000031), ref: 004017B0
                                                                                                                                                                                      • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,00441000,?,?,00000031), ref: 004017D5
                                                                                                                                                                                        • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                        • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\), ref: 0040560C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsi277F.tmp$C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dll$get
                                                                                                                                                                                      • API String ID: 1941528284-4116067313
                                                                                                                                                                                      • Opcode ID: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                      • Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
                                                                                                                                                                                      • Opcode Fuzzy Hash: f7e64eeb5d3c4bf8a05a3440747446d68def3c8d7aa8c7c6583b7de4a42550af
                                                                                                                                                                                      • Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D
                                                                                                                                                                                      Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 691 40559f-4055b4 692 4055ba-4055cb 691->692 693 40566b-40566f 691->693 694 4055d6-4055e2 lstrlenW 692->694 695 4055cd-4055d1 call 40657a 692->695 697 4055e4-4055f4 lstrlenW 694->697 698 4055ff-405603 694->698 695->694 697->693 699 4055f6-4055fa lstrcatW 697->699 700 405612-405616 698->700 701 405605-40560c SetWindowTextW 698->701 699->698 702 405618-40565a SendMessageW * 3 700->702 703 40565c-40565e 700->703 701->700 702->703 703->693 704 405660-405663 703->704 704->693
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                      • lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                      • lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                      • SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\), ref: 0040560C
                                                                                                                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                      • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                      • SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000), ref: 00406779
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                      • String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\
                                                                                                                                                                                      • API String ID: 1495540970-1575135097
                                                                                                                                                                                      • Opcode ID: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                      • Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 195069dcc2a5024ac29c7a45bf60c8768b6efe327543dfefb6c4dd5180e0e504
                                                                                                                                                                                      • Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68
                                                                                                                                                                                      Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 705 4026ec-402705 call 402d84 708 402c2a-402c2d 705->708 709 40270b-402712 705->709 710 402c33-402c39 708->710 711 402714 709->711 712 402717-40271a 709->712 711->712 713 402720-40272f call 40649d 712->713 714 40287e-402886 712->714 713->714 718 402735 713->718 714->708 719 40273b-40273f 718->719 720 4027d4-4027d7 719->720 721 402745-402760 ReadFile 719->721 723 4027d9-4027dc 720->723 724 4027ef-4027ff call 4060b0 720->724 721->714 722 402766-40276b 721->722 722->714 726 402771-40277f 722->726 723->724 727 4027de-4027e9 call 40610e 723->727 724->714 733 402801 724->733 730 402785-402797 MultiByteToWideChar 726->730 731 40283a-402846 call 406484 726->731 727->714 727->724 730->733 734 402799-40279c 730->734 731->710 736 402804-402807 733->736 737 40279e-4027a9 734->737 736->731 739 402809-40280e 736->739 737->736 740 4027ab-4027d0 SetFilePointer MultiByteToWideChar 737->740 741 402810-402815 739->741 742 40284b-40284f 739->742 740->737 743 4027d2 740->743 741->742 746 402817-40282a 741->746 744 402851-402855 742->744 745 40286c-402878 SetFilePointer 742->745 743->733 747 402857-40285b 744->747 748 40285d-40286a 744->748 745->714 746->714 749 40282c-402832 746->749 747->745 747->748 748->714 749->719 750 402838 749->750 750->714
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                        • Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124
                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                      • String ID: 9
                                                                                                                                                                                      • API String ID: 163830602-2366072709
                                                                                                                                                                                      • Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                      • Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
                                                                                                                                                                                      • Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
                                                                                                                                                                                      • Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58
                                                                                                                                                                                      Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 751 40689a-4068ba GetSystemDirectoryW 752 4068bc 751->752 753 4068be-4068c0 751->753 752->753 754 4068d1-4068d3 753->754 755 4068c2-4068cb 753->755 757 4068d4-406907 wsprintfW LoadLibraryExW 754->757 755->754 756 4068cd-4068cf 755->756 756->757
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                      • wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                      • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                      • API String ID: 2200240437-1946221925
                                                                                                                                                                                      • Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                      • Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
                                                                                                                                                                                      • Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8
                                                                                                                                                                                      Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 758 405a6e-405ab9 CreateDirectoryW 759 405abb-405abd 758->759 760 405abf-405acc GetLastError 758->760 761 405ae6-405ae8 759->761 760->761 762 405ace-405ae2 SetFileSecurityW 760->762 762->759 763 405ae4 GetLastError 762->763 763->761
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405AC5
                                                                                                                                                                                      • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405AE4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 3449924974-3081826266
                                                                                                                                                                                      • Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                      • Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9
                                                                                                                                                                                      Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 764 401d81-401d85 765 401d94-401d9a GetDlgItem 764->765 766 401d87-401d92 call 402d84 764->766 767 401da0-401dcc 765->767 766->767 770 401dd7 767->770 771 401dce-401dd5 call 402da6 767->771 773 401ddb-401e31 GetClientRect LoadImageW SendMessageW 770->773 771->773 775 401e33-401e36 773->775 776 401e3f-401e42 773->776 775->776 777 401e38-401e39 DeleteObject 775->777 778 401e48 776->778 779 402c2a-402c39 776->779 777->776 778->779
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                      • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                      • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1849352358-0
                                                                                                                                                                                      • Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                      • Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98
                                                                                                                                                                                      Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 782 401c43-401c63 call 402d84 * 2 787 401c65-401c6c call 402da6 782->787 788 401c6f-401c73 782->788 787->788 790 401c75-401c7c call 402da6 788->790 791 401c7f-401c85 788->791 790->791 794 401cd3-401cfd call 402da6 * 2 FindWindowExW 791->794 795 401c87-401ca3 call 402d84 * 2 791->795 805 401d03 794->805 806 401cc3-401cd1 SendMessageW 795->806 807 401ca5-401cc1 SendMessageTimeoutW 795->807 808 401d06-401d09 805->808 806->805 807->808 809 402c2a-402c39 808->809 810 401d0f 808->810 810->809
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Timeout
                                                                                                                                                                                      • String ID: !
                                                                                                                                                                                      • API String ID: 1777923405-2657877971
                                                                                                                                                                                      • Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                      • Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
                                                                                                                                                                                      • Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
                                                                                                                                                                                      • Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                      Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi277F.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                      • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseValuelstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsi277F.tmp
                                                                                                                                                                                      • API String ID: 2655323295-3430339873
                                                                                                                                                                                      • Opcode ID: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                      • Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3f2741e17913f4b3ae47e715a678bc9f1b76d5c80f35dbb4c6e867a5b8f0e772
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58
                                                                                                                                                                                      Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                      • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                      • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 3248276644-3049482934
                                                                                                                                                                                      • Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                      • Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
                                                                                                                                                                                      • Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
                                                                                                                                                                                      • Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE
                                                                                                                                                                                      Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040607A
                                                                                                                                                                                      • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CountFileNameTempTick
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                      • API String ID: 1716503409-678247507
                                                                                                                                                                                      • Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                      • Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
                                                                                                                                                                                      • Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768
                                                                                                                                                                                      Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 00403B78
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Free$GlobalLibrary
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 1100898210-3081826266
                                                                                                                                                                                      • Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                      • Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
                                                                                                                                                                                      • Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC
                                                                                                                                                                                      Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                        • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\), ref: 0040560C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 334405425-0
                                                                                                                                                                                      • Opcode ID: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                      • Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0bf0e5e813b2564cc7cfb612efcde4c797e71ce7d2922b3564d4c07743ad1514
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D
                                                                                                                                                                                      Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalFree.KERNELBASE(02A53C28), ref: 00401C0B
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000), ref: 00406779
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                      • String ID: get
                                                                                                                                                                                      • API String ID: 3292104215-4248514160
                                                                                                                                                                                      • Opcode ID: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                      • Instruction ID: 7c0f58a685d1fc6dd3685da305ee1819882fb4420ac17dc2787245939102450a
                                                                                                                                                                                      • Opcode Fuzzy Hash: f7499587b74b1f9cb3fce9f730428132cfcdd1475af0708a05741156e8f6fa82
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B21D872904210EBDB20AFA8EE84A5E73B4EB04715755063BF552F72D0D7B8AC414B9D
                                                                                                                                                                                      Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                      • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Enum$CloseValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 397863658-0
                                                                                                                                                                                      • Opcode ID: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                      • Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 89c6ceebaf26a2410158c75cc71a1e3b778611476644ea09d24f59567d4f9c93
                                                                                                                                                                                      • Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D
                                                                                                                                                                                      Function 00405C01 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00406008: GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                        • Part of subcall function 00406008: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C1C
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,?,?,00000000,00405DE3), ref: 00405C24
                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C3C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1655745494-0
                                                                                                                                                                                      • Opcode ID: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                      • Instruction ID: 0274c5225d47ddc366315f3a2fda4b694ad97aa72442a0e2fcdbaf00fd257d87
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8eed124eda4cbc8430ddba83c09443e031bc029d4ce3365f7fb32bc961faff32
                                                                                                                                                                                      • Instruction Fuzzy Hash: F4E0E53110CF9156E61457309E08F5F2AD8EF86715F05493EF892B10C0CBB848068E6A
                                                                                                                                                                                      Function 00404472 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(00000408,?,00000000,004040D1), ref: 00404490
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID: x
                                                                                                                                                                                      • API String ID: 3850602802-2363233923
                                                                                                                                                                                      • Opcode ID: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                      • Instruction ID: 1b38e0d23eed931a714c5b599c5829f4d2050063c4158495342b67dc2c27a344
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6afabcb65d7cd0472edcecb82606307073186cf957424f1b3ed57c3b76b5cfb8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 10C01271140200EACB004B00DE01F0A7A20B7A0B02F209039F381210B087B05422DB0C
                                                                                                                                                                                      Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                        • Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                        • Part of subcall function 00405A6E: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
                                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,00441000,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1892508949-0
                                                                                                                                                                                      • Opcode ID: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                      • Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
                                                                                                                                                                                      • Opcode Fuzzy Hash: e89a9e6a3f09ade376d0d4b3fd71c203f5cd3ef8be9bd613e1140dffb9deb40c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E
                                                                                                                                                                                      Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsi277F.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseQueryValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3356406503-0
                                                                                                                                                                                      • Opcode ID: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                      • Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3fb0128ec3c0afb48f28764f09fc95c95f98cfbd5e462e7a9813c2ba4e742ed8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D
                                                                                                                                                                                      Function 00401F12 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00405B63: ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                        • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                        • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCodeExecuteExitHandleObjectProcessShellSingleWait
                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                      • API String ID: 165873841-2766056989
                                                                                                                                                                                      • Opcode ID: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                      • Instruction ID: 706d8f23dd4fc365793d21c3b3cee38f3579e955c6bce5a1691758ef83551cc9
                                                                                                                                                                                      • Opcode Fuzzy Hash: e9e6b888b2ac62b7866e10c79cc816c8736e15ae282fdec460a2aeb23ba8a534
                                                                                                                                                                                      • Instruction Fuzzy Hash: 20115B71E042189ADB50EFB9CA49B8CB6F4BF04304F24447AE405F72C1EBBC89459B18
                                                                                                                                                                                      Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                      • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                      • Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
                                                                                                                                                                                      • Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C
                                                                                                                                                                                      Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000000), ref: 00401EFC
                                                                                                                                                                                      • EnableWindow.USER32(00000000,00000000), ref: 00401F07
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$EnableShow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1136574915-0
                                                                                                                                                                                      • Opcode ID: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                      • Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5ade1ed26a80a7dd8760c06c43378076533002221f41e68569be4ee1dd8de31a
                                                                                                                                                                                      • Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D
                                                                                                                                                                                      Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateHandleProcess
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3712363035-0
                                                                                                                                                                                      • Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                      • Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78
                                                                                                                                                                                      Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,?), ref: 00406937
                                                                                                                                                                                        • Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
                                                                                                                                                                                        • Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
                                                                                                                                                                                        • Part of subcall function 0040689A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406900
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2547128583-0
                                                                                                                                                                                      • Opcode ID: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                      • Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6f78d3fdf53352f122fdb8e7e1f438bdfac4fae158339a91a146711bf240c1a4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E
                                                                                                                                                                                      Function 00402C05 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(?,0000000B,00000001), ref: 00402C14
                                                                                                                                                                                      • InvalidateRect.USER32(?), ref: 00402C24
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: InvalidateMessageRectSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 909852535-0
                                                                                                                                                                                      • Opcode ID: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                      • Instruction ID: 5efb85e177e5feb05262591b5578bbf68be0fc1facb886aaf0ec985341d6bcc2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0509652848a83ac1d7feddac23dc24ced32f84c0220a85d8a6f2313ae5a63aab
                                                                                                                                                                                      • Instruction Fuzzy Hash: CEE08C72700008FFEB01CBA4EE84DAEB779FB40315B00007AF502A00A0D7300D40DA28
                                                                                                                                                                                      Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                      • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$AttributesCreate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 415043291-0
                                                                                                                                                                                      • Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                      • Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
                                                                                                                                                                                      • Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15
                                                                                                                                                                                      Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406021
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                      • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                      • Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
                                                                                                                                                                                      • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                      • Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98
                                                                                                                                                                                      Function 00403B12 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CloseHandle.KERNEL32(FFFFFFFF,00403A5E,?), ref: 00403B1D
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\nsi277F.tmp\, xrefs: 00403B31
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\
                                                                                                                                                                                      • API String ID: 2962429428-4235891929
                                                                                                                                                                                      • Opcode ID: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                      • Instruction ID: 74b342ff74dc5917d60848dc34610585f5de2c5243f802b65b47dd8438b48b4d
                                                                                                                                                                                      • Opcode Fuzzy Hash: e86ec88962d2cddd060eb64ec5e150871475ae72b9f2b14f7d4b77a190cc5563
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5EC0123050470056D1646F749E4FE153B64AB4073EB600325B0F9B10F1CB3C5759895D
                                                                                                                                                                                      Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405AFF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1375471231-0
                                                                                                                                                                                      • Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                      • Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
                                                                                                                                                                                      • Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D
                                                                                                                                                                                      Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,?,00000000,?,?), ref: 004028AF
                                                                                                                                                                                        • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FilePointerwsprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 327478801-0
                                                                                                                                                                                      • Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                      • Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
                                                                                                                                                                                      • Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D
                                                                                                                                                                                      Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Create
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2289755597-0
                                                                                                                                                                                      • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                      • Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
                                                                                                                                                                                      • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675
                                                                                                                                                                                      Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                      • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                      • Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                      • Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4
                                                                                                                                                                                      Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileRead
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2738559852-0
                                                                                                                                                                                      • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                      • Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                      • Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4
                                                                                                                                                                                      Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Remove folder: ,?), ref: 004063CE
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 71445658-0
                                                                                                                                                                                      • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                      • Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764
                                                                                                                                                                                      Function 00404499 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000), ref: 00406779
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,?,00000000), ref: 004044B3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ItemTextlstrcatlstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 281422827-0
                                                                                                                                                                                      • Opcode ID: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                      • Instruction ID: 6ac98b26730712a62f5b3967fa7f39b4c61dbbfa6ef1674fce18da22a1fc1fc0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 686190c6e4e1e5cc0914df72c0c951126eb576f2e70f28df627782bea9933419
                                                                                                                                                                                      • Instruction Fuzzy Hash: D3C08C35008200BFD641A714EC42F0FB7A8FFA031AF00C42EB05CA10D1C63494208A2A
                                                                                                                                                                                      Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(0002048C,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                      • Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
                                                                                                                                                                                      • Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
                                                                                                                                                                                      • Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C
                                                                                                                                                                                      Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ShellExecuteExW.SHELL32(?), ref: 00405B72
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExecuteShell
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 587946157-0
                                                                                                                                                                                      • Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                      • Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
                                                                                                                                                                                      • Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29
                                                                                                                                                                                      Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                      • Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
                                                                                                                                                                                      • Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08
                                                                                                                                                                                      Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FilePointer
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 973152223-0
                                                                                                                                                                                      • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                      • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                      • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                      Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CallbackDispatcherUser
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2492992576-0
                                                                                                                                                                                      • Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                      • Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
                                                                                                                                                                                      • Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
                                                                                                                                                                                      • Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D
                                                                                                                                                                                      Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
                                                                                                                                                                                        • Part of subcall function 0040559F: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00403418,00403418,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000,00424420,74DF23A0), ref: 004055FA
                                                                                                                                                                                        • Part of subcall function 0040559F: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\), ref: 0040560C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
                                                                                                                                                                                        • Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A
                                                                                                                                                                                        • Part of subcall function 00405B20: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
                                                                                                                                                                                        • Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                        • Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
                                                                                                                                                                                        • Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8
                                                                                                                                                                                        • Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2972824698-0
                                                                                                                                                                                      • Opcode ID: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                      • Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 11aaa4362747121357e125e8dbb3e446f77891c3c0f7104508ea78bcc2682684
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                      Function 0040498A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003FB), ref: 004049D9
                                                                                                                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 00404A03
                                                                                                                                                                                      • SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
                                                                                                                                                                                      • CoTaskMemFree.OLE32(00000000), ref: 00404ABF
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(Remove folder: ,0042D268,00000000,?,?), ref: 00404AF1
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404AFD
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B0F
                                                                                                                                                                                        • Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94
                                                                                                                                                                                        • Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                        • Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                        • Part of subcall function 004067C4: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                        • Part of subcall function 004067C4: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                      • GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 00404BD2
                                                                                                                                                                                      • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED
                                                                                                                                                                                        • Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                        • Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                        • Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                      • String ID: A$C:\Users\user\AppData\Local\Temp\nsq4808.tmp$Remove folder: $liy
                                                                                                                                                                                      • API String ID: 2624150263-752593621
                                                                                                                                                                                      • Opcode ID: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                      • Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
                                                                                                                                                                                      • Opcode Fuzzy Hash: aac53df244383e2a07a9d2c6e377dc106276e891bc31ab3524a37a2d2ad96109
                                                                                                                                                                                      • Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D
                                                                                                                                                                                      Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 542301482-0
                                                                                                                                                                                      • Opcode ID: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                      • Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
                                                                                                                                                                                      • Opcode Fuzzy Hash: f0c7f0c58da5b2556a219b4126ec8a5e6c03aa9de5f34d462473648d541e39b0
                                                                                                                                                                                      • Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94
                                                                                                                                                                                      Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFindFirst
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1974802433-0
                                                                                                                                                                                      • Opcode ID: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                      • Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 23bc45f7dafbc09bf3d58dfb9668e04a20f74da7ffae18e0ad0b6f577034eb1d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29
                                                                                                                                                                                      Function 00406D85 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                      • Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
                                                                                                                                                                                      • Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
                                                                                                                                                                                      • Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45
                                                                                                                                                                                      Function 0040755C Relevance: .3, Instructions: 300COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                      • Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
                                                                                                                                                                                      • Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
                                                                                                                                                                                      • Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95
                                                                                                                                                                                      Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003F9), ref: 00404F1E
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000408), ref: 00404F29
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
                                                                                                                                                                                      • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
                                                                                                                                                                                      • SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
                                                                                                                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
                                                                                                                                                                                      • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
                                                                                                                                                                                      • SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
                                                                                                                                                                                      • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
                                                                                                                                                                                      • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 00405000
                                                                                                                                                                                      • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
                                                                                                                                                                                      • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
                                                                                                                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
                                                                                                                                                                                      • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102
                                                                                                                                                                                        • Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC
                                                                                                                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00405144
                                                                                                                                                                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
                                                                                                                                                                                      • ShowWindow.USER32(?,00000005), ref: 00405162
                                                                                                                                                                                      • SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
                                                                                                                                                                                      • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
                                                                                                                                                                                      • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
                                                                                                                                                                                      • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
                                                                                                                                                                                      • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
                                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 00405330
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 00405340
                                                                                                                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
                                                                                                                                                                                      • SendMessageW.USER32(?,00001102,?,?), ref: 00405462
                                                                                                                                                                                      • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
                                                                                                                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
                                                                                                                                                                                      • ShowWindow.USER32(?,00000000), ref: 004054EA
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003FE), ref: 004054F5
                                                                                                                                                                                      • ShowWindow.USER32(00000000), ref: 004054FC
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                      • String ID: $M$N
                                                                                                                                                                                      • API String ID: 2564846305-813528018
                                                                                                                                                                                      • Opcode ID: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                      • Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
                                                                                                                                                                                      • Opcode Fuzzy Hash: dd942b7cbeaa18c8cf4828e28d43e61687b6a80dcb186ef465745c56d9013c5d
                                                                                                                                                                                      • Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58
                                                                                                                                                                                      Function 00404658 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003E8), ref: 0040470A
                                                                                                                                                                                      • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
                                                                                                                                                                                      • GetSysColor.USER32(?), ref: 00404738
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
                                                                                                                                                                                      • lstrlenW.KERNEL32(?), ref: 00404759
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
                                                                                                                                                                                      • GetDlgItem.USER32(?,0000040A), ref: 004047D4
                                                                                                                                                                                      • SendMessageW.USER32(00000000), ref: 004047DB
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003E8), ref: 00404806
                                                                                                                                                                                      • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
                                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F02), ref: 00404857
                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 0040485A
                                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 00404873
                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 00404876
                                                                                                                                                                                      • SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
                                                                                                                                                                                      • SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                      • String ID: N$Remove folder: $liy
                                                                                                                                                                                      • API String ID: 3103080414-3893499323
                                                                                                                                                                                      • Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                      • Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
                                                                                                                                                                                      • Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98
                                                                                                                                                                                      Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                      • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                      • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                      • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                      • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                      • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                      • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                      • DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                      • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                      • String ID: F
                                                                                                                                                                                      • API String ID: 941294808-1304234792
                                                                                                                                                                                      • Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                      • Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
                                                                                                                                                                                      • Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4
                                                                                                                                                                                      Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
                                                                                                                                                                                      • GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7
                                                                                                                                                                                        • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                        • Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                      • GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
                                                                                                                                                                                      • wsprintfA.USER32 ref: 00406202
                                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
                                                                                                                                                                                      • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
                                                                                                                                                                                      • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
                                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 004062EB
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2
                                                                                                                                                                                        • Part of subcall function 0040602D: GetFileAttributesW.KERNEL32(00000003,004030BD,C:\Users\user\Desktop\Setup.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
                                                                                                                                                                                        • Part of subcall function 0040602D: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                      • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                      • API String ID: 2171350718-461813615
                                                                                                                                                                                      • Opcode ID: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                      • Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6dbc896bee28fc2cd17c6beb7c7e3b01e9a95bb407788db3ff507c40593cf796
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D
                                                                                                                                                                                      Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EB), ref: 0040451D
                                                                                                                                                                                      • GetSysColor.USER32(00000000), ref: 0040455B
                                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00404567
                                                                                                                                                                                      • SetBkMode.GDI32(?,?), ref: 00404573
                                                                                                                                                                                      • GetSysColor.USER32(?), ref: 00404586
                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 00404596
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004045B0
                                                                                                                                                                                      • CreateBrushIndirect.GDI32(?), ref: 004045BA
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2320649405-0
                                                                                                                                                                                      • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                      • Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
                                                                                                                                                                                      • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54
                                                                                                                                                                                      Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
                                                                                                                                                                                      • CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
                                                                                                                                                                                      • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
                                                                                                                                                                                      • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Char$Next$Prev
                                                                                                                                                                                      • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 589700163-4010320282
                                                                                                                                                                                      • Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                      • Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD
                                                                                                                                                                                      Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
                                                                                                                                                                                      • GetMessagePos.USER32 ref: 00404E77
                                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00404E91
                                                                                                                                                                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
                                                                                                                                                                                      • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$Send$ClientScreen
                                                                                                                                                                                      • String ID: f
                                                                                                                                                                                      • API String ID: 41195575-1993550816
                                                                                                                                                                                      • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                      • Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
                                                                                                                                                                                      • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5
                                                                                                                                                                                      Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                      • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
                                                                                                                                                                                        • Part of subcall function 0040657A: lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,?,004055D6,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\,00000000), ref: 00406779
                                                                                                                                                                                      • CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                      • String ID: MS Shell Dlg
                                                                                                                                                                                      • API String ID: 2584051700-76309092
                                                                                                                                                                                      • Opcode ID: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                      • Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7613f5a947f4bbf8195753a17fba9eaca46e1d6fc564812dac8d5fa739d0f051
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED
                                                                                                                                                                                      Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                      • MulDiv.KERNEL32(0002BCFB,00000064,0002E668), ref: 00402FDC
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00402FEC
                                                                                                                                                                                      • SetWindowTextW.USER32(?,?), ref: 00402FFC
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • verifying installer: %d%%, xrefs: 00402FE6
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                      • String ID: verifying installer: %d%%
                                                                                                                                                                                      • API String ID: 1451636040-82062127
                                                                                                                                                                                      • Opcode ID: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                      • Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34baaeb4f482044ab67dd7918236f7f229881b82dd6befd7adca30260b95ec65
                                                                                                                                                                                      • Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69
                                                                                                                                                                                      Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2667972263-0
                                                                                                                                                                                      • Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                      • Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8
                                                                                                                                                                                      Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                      • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1354259210-0
                                                                                                                                                                                      • Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                      • Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
                                                                                                                                                                                      • Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68
                                                                                                                                                                                      Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE7
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404DF0
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                      • String ID: %u.%u%s%s
                                                                                                                                                                                      • API String ID: 3540041739-3551169577
                                                                                                                                                                                      • Opcode ID: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                      • Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
                                                                                                                                                                                      • Opcode Fuzzy Hash: f5c410226751388561f0977026f7bc113d9509f0ffdd9d2834ff72966f8c02b6
                                                                                                                                                                                      • Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8
                                                                                                                                                                                      Function 00405EB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CharNextW.USER32(?,?,C:\,?,00405F2B,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
                                                                                                                                                                                      • CharNextW.USER32(00000000), ref: 00405ECA
                                                                                                                                                                                      • CharNextW.USER32(00000000), ref: 00405EE2
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext
                                                                                                                                                                                      • String ID: C:\
                                                                                                                                                                                      • API String ID: 3213498283-3404278061
                                                                                                                                                                                      • Opcode ID: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                      • Instruction ID: b7f7aa27055ddc775a1b47344aef2f77b81fec2ea34db2f3ccdabfa21b6bce3d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 389604e099afbb0f1c733809242fd9884b65eb47018f1a61235cb76474637dc7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7BF0F631810E1296DB317B548C44E7B97BCEB64354B04843BD741B71C0D3BC8D808BDA
                                                                                                                                                                                      Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
                                                                                                                                                                                      • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 2659869361-3081826266
                                                                                                                                                                                      • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                      • Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                      • Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD
                                                                                                                                                                                      Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: lstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsi277F.tmp$C:\Users\user\AppData\Local\Temp\nsi277F.tmp\inetc.dll
                                                                                                                                                                                      • API String ID: 1659193697-3411518719
                                                                                                                                                                                      • Opcode ID: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                      • Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
                                                                                                                                                                                      • Opcode Fuzzy Hash: fbd5ee5e4de60feb08ffa62b35b3018c7a91bb86716aa8782bbd76b946f17d50
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E
                                                                                                                                                                                      Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040304A
                                                                                                                                                                                      • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2102729457-0
                                                                                                                                                                                      • Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                      • Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
                                                                                                                                                                                      • Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
                                                                                                                                                                                      • Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D
                                                                                                                                                                                      Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 00405542
                                                                                                                                                                                      • CallWindowProcW.USER32(?,?,?,?), ref: 00405593
                                                                                                                                                                                        • Part of subcall function 004044E5: SendMessageW.USER32(0002048C,00000000,00000000,00000000), ref: 004044F7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3748168415-3916222277
                                                                                                                                                                                      • Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                      • Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
                                                                                                                                                                                      • Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69
                                                                                                                                                                                      Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Remove folder: ,?,?,00406672,80000002), ref: 00406451
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Remove folder: ,Remove folder: ,Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsi277F.tmp\), ref: 0040645C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseQueryValue
                                                                                                                                                                                      • String ID: Remove folder:
                                                                                                                                                                                      • API String ID: 3356406503-1958208860
                                                                                                                                                                                      • Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                      • Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
                                                                                                                                                                                      • Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
                                                                                                                                                                                      • Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8
                                                                                                                                                                                      Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
                                                                                                                                                                                      • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
                                                                                                                                                                                      • CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000000.00000002.2031611108.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000000.00000002.2031592878.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031629888.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.000000000043E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031646137.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000000.00000002.2031778618.000000000046E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_400000_Setup.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 190613189-0
                                                                                                                                                                                      • Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                      • Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:20.1%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                      Total number of Nodes:1386
                                                                                                                                                                                      Total number of Limit Nodes:31
                                                                                                                                                                                      execution_graph 3224 403640 SetErrorMode GetVersionExW 3225 403692 GetVersionExW 3224->3225 3226 4036ca 3224->3226 3225->3226 3227 403723 3226->3227 3228 406a35 5 API calls 3226->3228 3314 4069c5 GetSystemDirectoryW 3227->3314 3228->3227 3230 403739 lstrlenA 3230->3227 3231 403749 3230->3231 3317 406a35 GetModuleHandleA 3231->3317 3234 406a35 5 API calls 3235 403757 3234->3235 3236 406a35 5 API calls 3235->3236 3237 403763 #17 OleInitialize SHGetFileInfoW 3236->3237 3323 406668 lstrcpynW 3237->3323 3240 4037b0 GetCommandLineW 3324 406668 lstrcpynW 3240->3324 3242 4037c2 3325 405f64 3242->3325 3245 4038f7 3246 40390b GetTempPathW 3245->3246 3329 40360f 3246->3329 3248 403923 3250 403927 GetWindowsDirectoryW lstrcatW 3248->3250 3251 40397d DeleteFileW 3248->3251 3249 405f64 CharNextW 3253 4037f9 3249->3253 3254 40360f 12 API calls 3250->3254 3339 4030d0 GetTickCount GetModuleFileNameW 3251->3339 3253->3245 3253->3249 3258 4038f9 3253->3258 3256 403943 3254->3256 3255 403990 3259 403b6c ExitProcess CoUninitialize 3255->3259 3261 403a45 3255->3261 3268 405f64 CharNextW 3255->3268 3256->3251 3257 403947 GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 3256->3257 3260 40360f 12 API calls 3257->3260 3426 406668 lstrcpynW 3258->3426 3263 403b91 3259->3263 3264 403b7c 3259->3264 3267 403975 3260->3267 3369 403d17 3261->3369 3265 403b99 GetCurrentProcess OpenProcessToken 3263->3265 3266 403c0f ExitProcess 3263->3266 3480 405cc8 3264->3480 3271 403bb0 LookupPrivilegeValueW AdjustTokenPrivileges 3265->3271 3272 403bdf 3265->3272 3267->3251 3267->3259 3283 4039b2 3268->3283 3271->3272 3276 406a35 5 API calls 3272->3276 3273 403a54 3273->3259 3279 403be6 3276->3279 3277 403a1b 3427 40603f 3277->3427 3278 403a5c 3443 405c33 3278->3443 3281 403bfb ExitWindowsEx 3279->3281 3285 403c08 3279->3285 3281->3266 3281->3285 3283->3277 3283->3278 3484 40140b 3285->3484 3288 403a72 lstrcatW 3289 403a7d lstrcatW lstrcmpiW 3288->3289 3289->3273 3290 403a9d 3289->3290 3292 403aa2 3290->3292 3293 403aa9 3290->3293 3446 405b99 CreateDirectoryW 3292->3446 3451 405c16 CreateDirectoryW 3293->3451 3294 403a3a 3442 406668 lstrcpynW 3294->3442 3299 403aae SetCurrentDirectoryW 3300 403ac0 3299->3300 3301 403acb 3299->3301 3454 406668 lstrcpynW 3300->3454 3455 406668 lstrcpynW 3301->3455 3306 403b19 CopyFileW 3310 403ad8 3306->3310 3307 403b63 3309 406428 36 API calls 3307->3309 3309->3273 3310->3307 3311 4066a5 17 API calls 3310->3311 3313 403b4d CloseHandle 3310->3313 3456 4066a5 3310->3456 3473 406428 MoveFileExW 3310->3473 3477 405c4b CreateProcessW 3310->3477 3311->3310 3313->3310 3315 4069e7 wsprintfW LoadLibraryExW 3314->3315 3315->3230 3318 406a51 3317->3318 3319 406a5b GetProcAddress 3317->3319 3320 4069c5 3 API calls 3318->3320 3321 403750 3319->3321 3322 406a57 3320->3322 3321->3234 3322->3319 3322->3321 3323->3240 3324->3242 3326 405f6a 3325->3326 3327 4037e8 CharNextW 3326->3327 3328 405f71 CharNextW 3326->3328 3327->3253 3328->3326 3487 4068ef 3329->3487 3331 403625 3331->3248 3332 40361b 3332->3331 3496 405f37 lstrlenW CharPrevW 3332->3496 3335 405c16 2 API calls 3336 403633 3335->3336 3499 406187 3336->3499 3503 406158 GetFileAttributesW CreateFileW 3339->3503 3341 403113 3368 403120 3341->3368 3504 406668 lstrcpynW 3341->3504 3343 403136 3505 405f83 lstrlenW 3343->3505 3347 403147 GetFileSize 3348 403241 3347->3348 3367 40315e 3347->3367 3510 40302e 3348->3510 3352 403286 GlobalAlloc 3355 40329d 3352->3355 3354 4032de 3356 40302e 32 API calls 3354->3356 3359 406187 2 API calls 3355->3359 3356->3368 3357 403267 3358 4035e2 ReadFile 3357->3358 3360 403272 3358->3360 3362 4032ae CreateFileW 3359->3362 3360->3352 3360->3368 3361 40302e 32 API calls 3361->3367 3363 4032e8 3362->3363 3362->3368 3525 4035f8 SetFilePointer 3363->3525 3365 4032f6 3526 403371 3365->3526 3367->3348 3367->3354 3367->3361 3367->3368 3541 4035e2 3367->3541 3368->3255 3370 406a35 5 API calls 3369->3370 3371 403d2b 3370->3371 3372 403d31 3371->3372 3373 403d43 3371->3373 3596 4065af wsprintfW 3372->3596 3597 406536 3373->3597 3377 403d92 lstrcatW 3378 403d41 3377->3378 3588 403fed 3378->3588 3379 406536 3 API calls 3379->3377 3382 40603f 18 API calls 3383 403dc4 3382->3383 3384 403e58 3383->3384 3386 406536 3 API calls 3383->3386 3385 40603f 18 API calls 3384->3385 3387 403e5e 3385->3387 3393 403df6 3386->3393 3388 403e6e LoadImageW 3387->3388 3389 4066a5 17 API calls 3387->3389 3390 403f14 3388->3390 3391 403e95 RegisterClassW 3388->3391 3389->3388 3395 40140b 2 API calls 3390->3395 3394 403ecb SystemParametersInfoW CreateWindowExW 3391->3394 3424 403f1e 3391->3424 3392 403e17 lstrlenW 3397 403e25 lstrcmpiW 3392->3397 3398 403e4b 3392->3398 3393->3384 3393->3392 3396 405f64 CharNextW 3393->3396 3394->3390 3399 403f1a 3395->3399 3400 403e14 3396->3400 3397->3398 3401 403e35 GetFileAttributesW 3397->3401 3402 405f37 3 API calls 3398->3402 3404 403fed 18 API calls 3399->3404 3399->3424 3400->3392 3403 403e41 3401->3403 3405 403e51 3402->3405 3403->3398 3406 405f83 2 API calls 3403->3406 3407 403f2b 3404->3407 3602 406668 lstrcpynW 3405->3602 3406->3398 3409 403f37 ShowWindow 3407->3409 3410 403fba 3407->3410 3411 4069c5 3 API calls 3409->3411 3603 40579d OleInitialize 3410->3603 3413 403f4f 3411->3413 3415 403f5d GetClassInfoW 3413->3415 3418 4069c5 3 API calls 3413->3418 3414 403fc0 3416 403fc4 3414->3416 3417 403fdc 3414->3417 3420 403f71 GetClassInfoW RegisterClassW 3415->3420 3421 403f87 DialogBoxParamW 3415->3421 3422 40140b 2 API calls 3416->3422 3416->3424 3419 40140b 2 API calls 3417->3419 3418->3415 3419->3424 3420->3421 3423 40140b 2 API calls 3421->3423 3422->3424 3425 403faf 3423->3425 3424->3273 3425->3424 3426->3246 3625 406668 lstrcpynW 3427->3625 3429 406050 3626 405fe2 CharNextW CharNextW 3429->3626 3432 403a27 3432->3259 3441 406668 lstrcpynW 3432->3441 3433 4068ef 5 API calls 3439 406066 3433->3439 3434 406097 lstrlenW 3435 4060a2 3434->3435 3434->3439 3436 405f37 3 API calls 3435->3436 3438 4060a7 GetFileAttributesW 3436->3438 3438->3432 3439->3432 3439->3434 3440 405f83 2 API calls 3439->3440 3632 40699e FindFirstFileW 3439->3632 3440->3434 3441->3294 3442->3261 3444 406a35 5 API calls 3443->3444 3445 403a61 lstrcatW 3444->3445 3445->3288 3445->3289 3447 403aa7 3446->3447 3448 405bea GetLastError 3446->3448 3447->3299 3448->3447 3449 405bf9 SetFileSecurityW 3448->3449 3449->3447 3450 405c0f GetLastError 3449->3450 3450->3447 3452 405c2a GetLastError 3451->3452 3453 405c26 3451->3453 3452->3453 3453->3299 3454->3301 3455->3310 3460 4066b2 3456->3460 3457 4068d5 3458 403b0d DeleteFileW 3457->3458 3637 406668 lstrcpynW 3457->3637 3458->3306 3458->3310 3460->3457 3461 4068a3 lstrlenW 3460->3461 3462 4067ba GetSystemDirectoryW 3460->3462 3465 406536 3 API calls 3460->3465 3466 4066a5 10 API calls 3460->3466 3467 4067cd GetWindowsDirectoryW 3460->3467 3468 406844 lstrcatW 3460->3468 3469 4066a5 10 API calls 3460->3469 3470 4068ef 5 API calls 3460->3470 3471 4067fc SHGetSpecialFolderLocation 3460->3471 3635 4065af wsprintfW 3460->3635 3636 406668 lstrcpynW 3460->3636 3461->3460 3462->3460 3465->3460 3466->3461 3467->3460 3468->3460 3469->3460 3470->3460 3471->3460 3472 406814 SHGetPathFromIDListW CoTaskMemFree 3471->3472 3472->3460 3474 406449 3473->3474 3475 40643c 3473->3475 3474->3310 3638 4062ae 3475->3638 3478 405c8a 3477->3478 3479 405c7e CloseHandle 3477->3479 3478->3310 3479->3478 3483 405cdd 3480->3483 3481 403b89 ExitProcess 3482 405cf1 MessageBoxIndirectW 3482->3481 3483->3481 3483->3482 3485 401389 2 API calls 3484->3485 3486 401420 3485->3486 3486->3266 3488 4068fc 3487->3488 3490 406972 3488->3490 3491 406965 CharNextW 3488->3491 3493 405f64 CharNextW 3488->3493 3494 406951 CharNextW 3488->3494 3495 406960 CharNextW 3488->3495 3489 406977 CharPrevW 3489->3490 3490->3489 3492 406998 3490->3492 3491->3488 3491->3490 3492->3332 3493->3488 3494->3488 3495->3491 3497 405f53 lstrcatW 3496->3497 3498 40362d 3496->3498 3497->3498 3498->3335 3500 406194 GetTickCount GetTempFileNameW 3499->3500 3501 40363e 3500->3501 3502 4061ca 3500->3502 3501->3248 3502->3500 3502->3501 3503->3341 3504->3343 3506 405f91 3505->3506 3507 40313c 3506->3507 3508 405f97 CharPrevW 3506->3508 3509 406668 lstrcpynW 3507->3509 3508->3506 3508->3507 3509->3347 3511 403057 3510->3511 3512 40303f 3510->3512 3514 403067 GetTickCount 3511->3514 3515 40305f 3511->3515 3513 403048 DestroyWindow 3512->3513 3518 40304f 3512->3518 3513->3518 3517 403075 3514->3517 3514->3518 3545 406a71 3515->3545 3519 4030aa CreateDialogParamW ShowWindow 3517->3519 3520 40307d 3517->3520 3518->3352 3518->3368 3544 4035f8 SetFilePointer 3518->3544 3519->3518 3520->3518 3549 403012 3520->3549 3522 40308b wsprintfW 3552 4056ca 3522->3552 3525->3365 3527 403380 SetFilePointer 3526->3527 3528 40339c 3526->3528 3527->3528 3563 403479 GetTickCount 3528->3563 3533 403479 42 API calls 3534 4033d3 3533->3534 3535 40343f ReadFile 3534->3535 3539 4033e2 3534->3539 3540 403439 3534->3540 3535->3540 3537 4061db ReadFile 3537->3539 3539->3537 3539->3540 3578 40620a WriteFile 3539->3578 3540->3368 3542 4061db ReadFile 3541->3542 3543 4035f5 3542->3543 3543->3367 3544->3357 3546 406a8e PeekMessageW 3545->3546 3547 406a84 DispatchMessageW 3546->3547 3548 406a9e 3546->3548 3547->3546 3548->3518 3550 403021 3549->3550 3551 403023 MulDiv 3549->3551 3550->3551 3551->3522 3553 4056e5 3552->3553 3554 4030a8 3552->3554 3555 405701 lstrlenW 3553->3555 3556 4066a5 17 API calls 3553->3556 3554->3518 3557 40572a 3555->3557 3558 40570f lstrlenW 3555->3558 3556->3555 3559 405730 SetWindowTextW 3557->3559 3560 40573d 3557->3560 3558->3554 3561 405721 lstrcatW 3558->3561 3559->3560 3560->3554 3562 405743 SendMessageW SendMessageW SendMessageW 3560->3562 3561->3557 3562->3554 3564 4035d1 3563->3564 3565 4034a7 3563->3565 3566 40302e 32 API calls 3564->3566 3580 4035f8 SetFilePointer 3565->3580 3573 4033a3 3566->3573 3568 4034b2 SetFilePointer 3572 4034d7 3568->3572 3569 4035e2 ReadFile 3569->3572 3571 40302e 32 API calls 3571->3572 3572->3569 3572->3571 3572->3573 3574 40620a WriteFile 3572->3574 3575 4035b2 SetFilePointer 3572->3575 3581 406bb0 3572->3581 3573->3540 3576 4061db ReadFile 3573->3576 3574->3572 3575->3564 3577 4033bc 3576->3577 3577->3533 3577->3540 3579 406228 3578->3579 3579->3539 3580->3568 3582 406bd5 3581->3582 3583 406bdd 3581->3583 3582->3572 3583->3582 3584 406c64 GlobalFree 3583->3584 3585 406c6d GlobalAlloc 3583->3585 3586 406ce4 GlobalAlloc 3583->3586 3587 406cdb GlobalFree 3583->3587 3584->3585 3585->3582 3585->3583 3586->3582 3586->3583 3587->3586 3589 404001 3588->3589 3610 4065af wsprintfW 3589->3610 3591 404072 3611 4040a6 3591->3611 3593 403da2 3593->3382 3594 404077 3594->3593 3595 4066a5 17 API calls 3594->3595 3595->3594 3596->3378 3614 4064d5 3597->3614 3600 403d73 3600->3377 3600->3379 3601 40656a RegQueryValueExW RegCloseKey 3601->3600 3602->3384 3618 404610 3603->3618 3605 4057e7 3606 404610 SendMessageW 3605->3606 3608 4057f9 OleUninitialize 3606->3608 3607 4057c0 3607->3605 3621 401389 3607->3621 3608->3414 3610->3591 3612 4066a5 17 API calls 3611->3612 3613 4040b4 SetWindowTextW 3612->3613 3613->3594 3615 4064e4 3614->3615 3616 4064e8 3615->3616 3617 4064ed RegOpenKeyExW 3615->3617 3616->3600 3616->3601 3617->3616 3619 404628 3618->3619 3620 404619 SendMessageW 3618->3620 3619->3607 3620->3619 3623 401390 3621->3623 3622 4013fe 3622->3607 3623->3622 3624 4013cb MulDiv SendMessageW 3623->3624 3624->3623 3625->3429 3627 405fff 3626->3627 3629 406011 3626->3629 3628 40600c CharNextW 3627->3628 3627->3629 3631 406035 3628->3631 3630 405f64 CharNextW 3629->3630 3629->3631 3630->3629 3631->3432 3631->3433 3633 4069b4 FindClose 3632->3633 3634 4069bf 3632->3634 3633->3634 3634->3439 3635->3460 3636->3460 3637->3458 3639 406304 GetShortPathNameW 3638->3639 3640 4062de 3638->3640 3641 406423 3639->3641 3642 406319 3639->3642 3665 406158 GetFileAttributesW CreateFileW 3640->3665 3641->3474 3642->3641 3644 406321 wsprintfA 3642->3644 3646 4066a5 17 API calls 3644->3646 3645 4062e8 CloseHandle GetShortPathNameW 3645->3641 3647 4062fc 3645->3647 3648 406349 3646->3648 3647->3639 3647->3641 3666 406158 GetFileAttributesW CreateFileW 3648->3666 3650 406356 3650->3641 3651 406365 GetFileSize GlobalAlloc 3650->3651 3652 406387 3651->3652 3653 40641c CloseHandle 3651->3653 3654 4061db ReadFile 3652->3654 3653->3641 3655 40638f 3654->3655 3655->3653 3667 4060bd lstrlenA 3655->3667 3658 4063a6 lstrcpyA 3661 4063c8 3658->3661 3659 4063ba 3660 4060bd 4 API calls 3659->3660 3660->3661 3662 4063ff SetFilePointer 3661->3662 3663 40620a WriteFile 3662->3663 3664 406415 GlobalFree 3663->3664 3664->3653 3665->3645 3666->3650 3668 4060fe lstrlenA 3667->3668 3669 406106 3668->3669 3670 4060d7 lstrcmpiA 3668->3670 3669->3658 3669->3659 3670->3669 3671 4060f5 CharNextA 3670->3671 3671->3668 3672 401941 3673 401943 3672->3673 3678 402da6 3673->3678 3679 402db2 3678->3679 3680 4066a5 17 API calls 3679->3680 3681 402dd3 3680->3681 3682 401948 3681->3682 3683 4068ef 5 API calls 3681->3683 3684 405d74 3682->3684 3683->3682 3685 40603f 18 API calls 3684->3685 3686 405d94 3685->3686 3687 405d9c DeleteFileW 3686->3687 3688 405db3 3686->3688 3692 401951 3687->3692 3689 405ed3 3688->3689 3720 406668 lstrcpynW 3688->3720 3689->3692 3696 40699e 2 API calls 3689->3696 3691 405dd9 3693 405dec 3691->3693 3694 405ddf lstrcatW 3691->3694 3695 405f83 2 API calls 3693->3695 3697 405df2 3694->3697 3695->3697 3699 405ef8 3696->3699 3698 405e02 lstrcatW 3697->3698 3700 405e0d lstrlenW FindFirstFileW 3697->3700 3698->3700 3699->3692 3701 405f37 3 API calls 3699->3701 3700->3689 3718 405e2f 3700->3718 3702 405f02 3701->3702 3704 405d2c 5 API calls 3702->3704 3703 405eb6 FindNextFileW 3707 405ecc FindClose 3703->3707 3703->3718 3706 405f0e 3704->3706 3708 405f12 3706->3708 3709 405f28 3706->3709 3707->3689 3708->3692 3712 4056ca 24 API calls 3708->3712 3711 4056ca 24 API calls 3709->3711 3711->3692 3714 405f1f 3712->3714 3713 405d74 60 API calls 3713->3718 3716 406428 36 API calls 3714->3716 3715 4056ca 24 API calls 3715->3703 3716->3692 3717 4056ca 24 API calls 3717->3718 3718->3703 3718->3713 3718->3715 3718->3717 3719 406428 36 API calls 3718->3719 3721 406668 lstrcpynW 3718->3721 3722 405d2c 3718->3722 3719->3718 3720->3691 3721->3718 3730 406133 GetFileAttributesW 3722->3730 3725 405d47 RemoveDirectoryW 3728 405d55 3725->3728 3726 405d4f DeleteFileW 3726->3728 3727 405d59 3727->3718 3728->3727 3729 405d65 SetFileAttributesW 3728->3729 3729->3727 3731 405d38 3730->3731 3732 406145 SetFileAttributesW 3730->3732 3731->3725 3731->3726 3731->3727 3732->3731 3733 4015c1 3734 402da6 17 API calls 3733->3734 3735 4015c8 3734->3735 3736 405fe2 4 API calls 3735->3736 3748 4015d1 3736->3748 3737 401631 3738 401663 3737->3738 3739 401636 3737->3739 3743 401423 24 API calls 3738->3743 3752 401423 3739->3752 3740 405f64 CharNextW 3740->3748 3749 40165b 3743->3749 3745 405c16 2 API calls 3745->3748 3746 405c33 5 API calls 3746->3748 3747 40164a SetCurrentDirectoryW 3747->3749 3748->3737 3748->3740 3748->3745 3748->3746 3750 401617 GetFileAttributesW 3748->3750 3751 405b99 4 API calls 3748->3751 3750->3748 3751->3748 3753 4056ca 24 API calls 3752->3753 3754 401431 3753->3754 3755 406668 lstrcpynW 3754->3755 3755->3747 3992 401c43 3993 402d84 17 API calls 3992->3993 3994 401c4a 3993->3994 3995 402d84 17 API calls 3994->3995 3996 401c57 3995->3996 3997 402da6 17 API calls 3996->3997 3998 401c6c 3996->3998 3997->3998 3999 401c7c 3998->3999 4000 402da6 17 API calls 3998->4000 4001 401cd3 3999->4001 4002 401c87 3999->4002 4000->3999 4004 402da6 17 API calls 4001->4004 4003 402d84 17 API calls 4002->4003 4006 401c8c 4003->4006 4005 401cd8 4004->4005 4007 402da6 17 API calls 4005->4007 4008 402d84 17 API calls 4006->4008 4009 401ce1 FindWindowExW 4007->4009 4010 401c98 4008->4010 4013 401d03 4009->4013 4011 401cc3 SendMessageW 4010->4011 4012 401ca5 SendMessageTimeoutW 4010->4012 4011->4013 4012->4013 4021 4028c4 4022 4028ca 4021->4022 4023 4028d2 FindClose 4022->4023 4024 402c2a 4022->4024 4023->4024 4025 4040c5 4026 4040dd 4025->4026 4027 40423e 4025->4027 4026->4027 4028 4040e9 4026->4028 4029 40424f GetDlgItem GetDlgItem 4027->4029 4034 40428f 4027->4034 4031 4040f4 SetWindowPos 4028->4031 4032 404107 4028->4032 4113 4045c4 4029->4113 4030 4042e9 4035 404610 SendMessageW 4030->4035 4043 404239 4030->4043 4031->4032 4036 404110 ShowWindow 4032->4036 4037 404152 4032->4037 4034->4030 4042 401389 2 API calls 4034->4042 4065 4042fb 4035->4065 4044 404130 GetWindowLongW 4036->4044 4045 4041fc 4036->4045 4039 404171 4037->4039 4040 40415a DestroyWindow 4037->4040 4038 404279 SetClassLongW 4041 40140b 2 API calls 4038->4041 4047 404176 SetWindowLongW 4039->4047 4048 404187 4039->4048 4046 40454d 4040->4046 4041->4034 4049 4042c1 4042->4049 4044->4045 4051 404149 ShowWindow 4044->4051 4099 40462b 4045->4099 4046->4043 4058 40457e ShowWindow 4046->4058 4047->4043 4048->4045 4052 404193 GetDlgItem 4048->4052 4049->4030 4053 4042c5 SendMessageW 4049->4053 4051->4037 4056 4041c1 4052->4056 4057 4041a4 SendMessageW IsWindowEnabled 4052->4057 4053->4043 4054 40140b 2 API calls 4054->4065 4055 40454f DestroyWindow EndDialog 4055->4046 4060 4041ce 4056->4060 4063 404215 SendMessageW 4056->4063 4064 4041e1 4056->4064 4070 4041c6 4056->4070 4057->4043 4057->4056 4058->4043 4059 4066a5 17 API calls 4059->4065 4060->4063 4060->4070 4062 4045c4 18 API calls 4062->4065 4063->4045 4066 4041e9 4064->4066 4067 4041fe 4064->4067 4065->4043 4065->4054 4065->4055 4065->4059 4065->4062 4071 4045c4 18 API calls 4065->4071 4087 40448f DestroyWindow 4065->4087 4069 40140b 2 API calls 4066->4069 4068 40140b 2 API calls 4067->4068 4068->4070 4069->4070 4070->4045 4096 40459d 4070->4096 4072 404376 GetDlgItem 4071->4072 4073 404393 ShowWindow EnableWindow 4072->4073 4074 40438b 4072->4074 4116 4045e6 EnableWindow 4073->4116 4074->4073 4076 4043bd EnableWindow 4081 4043d1 4076->4081 4077 4043d6 GetSystemMenu EnableMenuItem SendMessageW 4078 404406 SendMessageW 4077->4078 4077->4081 4078->4081 4080 4040a6 18 API calls 4080->4081 4081->4077 4081->4080 4117 4045f9 SendMessageW 4081->4117 4118 406668 lstrcpynW 4081->4118 4083 404435 lstrlenW 4084 4066a5 17 API calls 4083->4084 4085 40444b SetWindowTextW 4084->4085 4086 401389 2 API calls 4085->4086 4086->4065 4087->4046 4088 4044a9 CreateDialogParamW 4087->4088 4088->4046 4089 4044dc 4088->4089 4090 4045c4 18 API calls 4089->4090 4091 4044e7 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 4090->4091 4092 401389 2 API calls 4091->4092 4093 40452d 4092->4093 4093->4043 4094 404535 ShowWindow 4093->4094 4095 404610 SendMessageW 4094->4095 4095->4046 4097 4045a4 4096->4097 4098 4045aa SendMessageW 4096->4098 4097->4098 4098->4045 4100 4046ee 4099->4100 4101 404643 GetWindowLongW 4099->4101 4100->4043 4101->4100 4102 404658 4101->4102 4102->4100 4103 404685 GetSysColor 4102->4103 4104 404688 4102->4104 4103->4104 4105 404698 SetBkMode 4104->4105 4106 40468e SetTextColor 4104->4106 4107 4046b0 GetSysColor 4105->4107 4108 4046b6 4105->4108 4106->4105 4107->4108 4109 4046c7 4108->4109 4110 4046bd SetBkColor 4108->4110 4109->4100 4111 4046e1 CreateBrushIndirect 4109->4111 4112 4046da DeleteObject 4109->4112 4110->4109 4111->4100 4112->4111 4114 4066a5 17 API calls 4113->4114 4115 4045cf SetDlgItemTextW 4114->4115 4115->4038 4116->4076 4117->4081 4118->4083 4122 4016cc 4123 402da6 17 API calls 4122->4123 4124 4016d2 GetFullPathNameW 4123->4124 4125 4016ec 4124->4125 4131 40170e 4124->4131 4127 40699e 2 API calls 4125->4127 4125->4131 4126 401723 GetShortPathNameW 4128 402c2a 4126->4128 4129 4016fe 4127->4129 4129->4131 4132 406668 lstrcpynW 4129->4132 4131->4126 4131->4128 4132->4131 4133 401e4e GetDC 4134 402d84 17 API calls 4133->4134 4135 401e60 GetDeviceCaps MulDiv ReleaseDC 4134->4135 4136 402d84 17 API calls 4135->4136 4137 401e91 4136->4137 4138 4066a5 17 API calls 4137->4138 4139 401ece CreateFontIndirectW 4138->4139 4140 402638 4139->4140 4140->4140 3896 402950 3897 402da6 17 API calls 3896->3897 3899 40295c 3897->3899 3898 402972 3901 406133 2 API calls 3898->3901 3899->3898 3900 402da6 17 API calls 3899->3900 3900->3898 3902 402978 3901->3902 3924 406158 GetFileAttributesW CreateFileW 3902->3924 3904 402985 3905 402a3b 3904->3905 3906 4029a0 GlobalAlloc 3904->3906 3907 402a23 3904->3907 3908 402a42 DeleteFileW 3905->3908 3909 402a55 3905->3909 3906->3907 3910 4029b9 3906->3910 3911 403371 44 API calls 3907->3911 3908->3909 3925 4035f8 SetFilePointer 3910->3925 3913 402a30 CloseHandle 3911->3913 3913->3905 3914 4029bf 3915 4035e2 ReadFile 3914->3915 3916 4029c8 GlobalAlloc 3915->3916 3917 4029d8 3916->3917 3918 402a0c 3916->3918 3919 403371 44 API calls 3917->3919 3920 40620a WriteFile 3918->3920 3923 4029e5 3919->3923 3921 402a18 GlobalFree 3920->3921 3921->3907 3922 402a03 GlobalFree 3922->3918 3923->3922 3924->3904 3925->3914 4148 403cd5 4149 403ce0 4148->4149 4150 403ce4 4149->4150 4151 403ce7 GlobalAlloc 4149->4151 4151->4150 4152 401956 4153 402da6 17 API calls 4152->4153 4154 40195d lstrlenW 4153->4154 4155 402638 4154->4155 4156 4014d7 4157 402d84 17 API calls 4156->4157 4158 4014dd Sleep 4157->4158 4160 402c2a 4158->4160 3926 4020d8 3927 4020ea 3926->3927 3937 40219c 3926->3937 3928 402da6 17 API calls 3927->3928 3929 4020f1 3928->3929 3931 402da6 17 API calls 3929->3931 3930 401423 24 API calls 3933 4022f6 3930->3933 3932 4020fa 3931->3932 3934 402110 LoadLibraryExW 3932->3934 3935 402102 GetModuleHandleW 3932->3935 3936 402121 3934->3936 3934->3937 3935->3934 3935->3936 3946 406aa4 3936->3946 3937->3930 3940 402132 3943 401423 24 API calls 3940->3943 3944 402142 3940->3944 3941 40216b 3942 4056ca 24 API calls 3941->3942 3942->3944 3943->3944 3944->3933 3945 40218e FreeLibrary 3944->3945 3945->3933 3951 40668a WideCharToMultiByte 3946->3951 3948 406ac1 3949 406ac8 GetProcAddress 3948->3949 3950 40212c 3948->3950 3949->3950 3950->3940 3950->3941 3951->3948 4161 402b59 4162 402b60 4161->4162 4163 402bab 4161->4163 4165 402ba9 4162->4165 4167 402d84 17 API calls 4162->4167 4164 406a35 5 API calls 4163->4164 4166 402bb2 4164->4166 4168 402da6 17 API calls 4166->4168 4169 402b6e 4167->4169 4170 402bbb 4168->4170 4171 402d84 17 API calls 4169->4171 4170->4165 4172 402bbf IIDFromString 4170->4172 4174 402b7a 4171->4174 4172->4165 4173 402bce 4172->4173 4173->4165 4179 406668 lstrcpynW 4173->4179 4178 4065af wsprintfW 4174->4178 4177 402beb CoTaskMemFree 4177->4165 4178->4165 4179->4177 4180 402a5b 4181 402d84 17 API calls 4180->4181 4182 402a61 4181->4182 4183 402aa4 4182->4183 4184 402a88 4182->4184 4189 40292e 4182->4189 4186 402abe 4183->4186 4187 402aae 4183->4187 4185 402a8d 4184->4185 4193 402a9e 4184->4193 4194 406668 lstrcpynW 4185->4194 4188 4066a5 17 API calls 4186->4188 4190 402d84 17 API calls 4187->4190 4188->4193 4190->4193 4193->4189 4195 4065af wsprintfW 4193->4195 4194->4189 4195->4189 3975 40175c 3976 402da6 17 API calls 3975->3976 3977 401763 3976->3977 3978 406187 2 API calls 3977->3978 3979 40176a 3978->3979 3980 406187 2 API calls 3979->3980 3980->3979 4196 401d5d 4197 402d84 17 API calls 4196->4197 4198 401d6e SetWindowLongW 4197->4198 4199 402c2a 4198->4199 4200 4028de 4201 4028e6 4200->4201 4202 4028ea FindNextFileW 4201->4202 4204 4028fc 4201->4204 4203 402943 4202->4203 4202->4204 4206 406668 lstrcpynW 4203->4206 4206->4204 4207 406d5f 4213 406be3 4207->4213 4208 40754e 4209 406c64 GlobalFree 4210 406c6d GlobalAlloc 4209->4210 4210->4208 4210->4213 4211 406ce4 GlobalAlloc 4211->4208 4211->4213 4212 406cdb GlobalFree 4212->4211 4213->4208 4213->4209 4213->4210 4213->4211 4213->4212 4214 401563 4215 402ba4 4214->4215 4218 4065af wsprintfW 4215->4218 4217 402ba9 4218->4217 4219 401968 4220 402d84 17 API calls 4219->4220 4221 40196f 4220->4221 4222 402d84 17 API calls 4221->4222 4223 40197c 4222->4223 4224 402da6 17 API calls 4223->4224 4225 401993 lstrlenW 4224->4225 4227 4019a4 4225->4227 4226 4019e5 4227->4226 4231 406668 lstrcpynW 4227->4231 4229 4019d5 4229->4226 4230 4019da lstrlenW 4229->4230 4230->4226 4231->4229 4239 40166a 4240 402da6 17 API calls 4239->4240 4241 401670 4240->4241 4242 40699e 2 API calls 4241->4242 4243 401676 4242->4243 4244 402aeb 4245 402d84 17 API calls 4244->4245 4246 402af1 4245->4246 4247 4066a5 17 API calls 4246->4247 4248 40292e 4246->4248 4247->4248 4249 4026ec 4250 402d84 17 API calls 4249->4250 4251 4026fb 4250->4251 4252 402745 ReadFile 4251->4252 4253 4061db ReadFile 4251->4253 4255 402785 MultiByteToWideChar 4251->4255 4256 40283a 4251->4256 4258 4027ab SetFilePointer MultiByteToWideChar 4251->4258 4259 40284b 4251->4259 4261 402838 4251->4261 4262 406239 SetFilePointer 4251->4262 4252->4251 4252->4261 4253->4251 4255->4251 4271 4065af wsprintfW 4256->4271 4258->4251 4260 40286c SetFilePointer 4259->4260 4259->4261 4260->4261 4263 406255 4262->4263 4266 40626d 4262->4266 4264 4061db ReadFile 4263->4264 4265 406261 4264->4265 4265->4266 4267 406276 SetFilePointer 4265->4267 4268 40629e SetFilePointer 4265->4268 4266->4251 4267->4268 4269 406281 4267->4269 4268->4266 4270 40620a WriteFile 4269->4270 4270->4266 4271->4261 4272 404a6e 4273 404aa4 4272->4273 4274 404a7e 4272->4274 4276 40462b 8 API calls 4273->4276 4275 4045c4 18 API calls 4274->4275 4277 404a8b SetDlgItemTextW 4275->4277 4278 404ab0 4276->4278 4277->4273 3855 40176f 3856 402da6 17 API calls 3855->3856 3857 401776 3856->3857 3858 401796 3857->3858 3859 40179e 3857->3859 3894 406668 lstrcpynW 3858->3894 3895 406668 lstrcpynW 3859->3895 3862 40179c 3866 4068ef 5 API calls 3862->3866 3863 4017a9 3864 405f37 3 API calls 3863->3864 3865 4017af lstrcatW 3864->3865 3865->3862 3886 4017bb 3866->3886 3867 40699e 2 API calls 3867->3886 3868 406133 2 API calls 3868->3886 3870 4017cd CompareFileTime 3870->3886 3871 40188d 3873 4056ca 24 API calls 3871->3873 3872 401864 3874 4056ca 24 API calls 3872->3874 3882 401879 3872->3882 3875 401897 3873->3875 3874->3882 3876 403371 44 API calls 3875->3876 3877 4018aa 3876->3877 3878 4018be SetFileTime 3877->3878 3879 4018d0 CloseHandle 3877->3879 3878->3879 3881 4018e1 3879->3881 3879->3882 3880 4066a5 17 API calls 3880->3886 3884 4018e6 3881->3884 3885 4018f9 3881->3885 3883 406668 lstrcpynW 3883->3886 3887 4066a5 17 API calls 3884->3887 3888 4066a5 17 API calls 3885->3888 3886->3867 3886->3868 3886->3870 3886->3871 3886->3872 3886->3880 3886->3883 3889 405cc8 MessageBoxIndirectW 3886->3889 3893 406158 GetFileAttributesW CreateFileW 3886->3893 3890 4018ee lstrcatW 3887->3890 3891 401901 3888->3891 3889->3886 3890->3891 3892 405cc8 MessageBoxIndirectW 3891->3892 3892->3882 3893->3886 3894->3862 3895->3863 4279 401a72 4280 402d84 17 API calls 4279->4280 4281 401a7b 4280->4281 4282 402d84 17 API calls 4281->4282 4283 401a20 4282->4283 4284 401573 4285 401583 ShowWindow 4284->4285 4286 40158c 4284->4286 4285->4286 4287 402c2a 4286->4287 4288 40159a ShowWindow 4286->4288 4288->4287 4289 4023f4 4290 402da6 17 API calls 4289->4290 4291 402403 4290->4291 4292 402da6 17 API calls 4291->4292 4293 40240c 4292->4293 4294 402da6 17 API calls 4293->4294 4295 402416 GetPrivateProfileStringW 4294->4295 4296 4014f5 SetForegroundWindow 4297 402c2a 4296->4297 4298 401ff6 4299 402da6 17 API calls 4298->4299 4300 401ffd 4299->4300 4301 40699e 2 API calls 4300->4301 4302 402003 4301->4302 4304 402014 4302->4304 4305 4065af wsprintfW 4302->4305 4305->4304 4306 401b77 4307 402da6 17 API calls 4306->4307 4308 401b7e 4307->4308 4309 402d84 17 API calls 4308->4309 4310 401b87 wsprintfW 4309->4310 4311 402c2a 4310->4311 4312 4046fa lstrcpynW lstrlenW 4313 40167b 4314 402da6 17 API calls 4313->4314 4315 401682 4314->4315 4316 402da6 17 API calls 4315->4316 4317 40168b 4316->4317 4318 402da6 17 API calls 4317->4318 4319 401694 MoveFileW 4318->4319 4320 4016a0 4319->4320 4321 4016a7 4319->4321 4323 401423 24 API calls 4320->4323 4322 40699e 2 API calls 4321->4322 4325 4022f6 4321->4325 4324 4016b6 4322->4324 4323->4325 4324->4325 4326 406428 36 API calls 4324->4326 4326->4320 4334 4019ff 4335 402da6 17 API calls 4334->4335 4336 401a06 4335->4336 4337 402da6 17 API calls 4336->4337 4338 401a0f 4337->4338 4339 401a16 lstrcmpiW 4338->4339 4340 401a28 lstrcmpW 4338->4340 4341 401a1c 4339->4341 4340->4341 4342 4022ff 4343 402da6 17 API calls 4342->4343 4344 402305 4343->4344 4345 402da6 17 API calls 4344->4345 4346 40230e 4345->4346 4347 402da6 17 API calls 4346->4347 4348 402317 4347->4348 4349 40699e 2 API calls 4348->4349 4350 402320 4349->4350 4351 402331 lstrlenW lstrlenW 4350->4351 4352 402324 4350->4352 4354 4056ca 24 API calls 4351->4354 4353 4056ca 24 API calls 4352->4353 4356 40232c 4352->4356 4353->4356 4355 40236f SHFileOperationW 4354->4355 4355->4352 4355->4356 4357 401000 4358 401037 BeginPaint GetClientRect 4357->4358 4359 40100c DefWindowProcW 4357->4359 4361 4010f3 4358->4361 4362 401179 4359->4362 4363 401073 CreateBrushIndirect FillRect DeleteObject 4361->4363 4364 4010fc 4361->4364 4363->4361 4365 401102 CreateFontIndirectW 4364->4365 4366 401167 EndPaint 4364->4366 4365->4366 4367 401112 6 API calls 4365->4367 4366->4362 4367->4366 4368 401d81 4369 401d94 GetDlgItem 4368->4369 4370 401d87 4368->4370 4372 401d8e 4369->4372 4371 402d84 17 API calls 4370->4371 4371->4372 4373 401dd5 GetClientRect LoadImageW SendMessageW 4372->4373 4375 402da6 17 API calls 4372->4375 4376 401e33 4373->4376 4378 401e3f 4373->4378 4375->4373 4377 401e38 DeleteObject 4376->4377 4376->4378 4377->4378 4379 401503 4380 40150b 4379->4380 4382 40151e 4379->4382 4381 402d84 17 API calls 4380->4381 4381->4382 4383 404783 4384 40479b 4383->4384 4388 4048b5 4383->4388 4389 4045c4 18 API calls 4384->4389 4385 40491f 4386 4049e9 4385->4386 4387 404929 GetDlgItem 4385->4387 4394 40462b 8 API calls 4386->4394 4390 404943 4387->4390 4391 4049aa 4387->4391 4388->4385 4388->4386 4392 4048f0 GetDlgItem SendMessageW 4388->4392 4393 404802 4389->4393 4390->4391 4399 404969 SendMessageW LoadCursorW SetCursor 4390->4399 4391->4386 4395 4049bc 4391->4395 4416 4045e6 EnableWindow 4392->4416 4397 4045c4 18 API calls 4393->4397 4398 4049e4 4394->4398 4400 4049d2 4395->4400 4401 4049c2 SendMessageW 4395->4401 4403 40480f CheckDlgButton 4397->4403 4420 404a32 4399->4420 4400->4398 4406 4049d8 SendMessageW 4400->4406 4401->4400 4402 40491a 4417 404a0e 4402->4417 4414 4045e6 EnableWindow 4403->4414 4406->4398 4409 40482d GetDlgItem 4415 4045f9 SendMessageW 4409->4415 4411 404843 SendMessageW 4412 404860 GetSysColor 4411->4412 4413 404869 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4411->4413 4412->4413 4413->4398 4414->4409 4415->4411 4416->4402 4418 404a21 SendMessageW 4417->4418 4419 404a1c 4417->4419 4418->4385 4419->4418 4423 405c8e ShellExecuteExW 4420->4423 4422 404998 LoadCursorW SetCursor 4422->4391 4423->4422 4424 402383 4425 40238a 4424->4425 4428 40239d 4424->4428 4426 4066a5 17 API calls 4425->4426 4427 402397 4426->4427 4429 405cc8 MessageBoxIndirectW 4427->4429 4429->4428 4430 402c05 SendMessageW 4431 402c2a 4430->4431 4432 402c1f InvalidateRect 4430->4432 4432->4431 3790 401389 3792 401390 3790->3792 3791 4013fe 3792->3791 3793 4013cb MulDiv SendMessageW 3792->3793 3793->3792 4433 405809 4434 4059b3 4433->4434 4435 40582a GetDlgItem GetDlgItem GetDlgItem 4433->4435 4437 4059e4 4434->4437 4438 4059bc GetDlgItem CreateThread CloseHandle 4434->4438 4478 4045f9 SendMessageW 4435->4478 4440 405a0f 4437->4440 4441 405a34 4437->4441 4442 4059fb ShowWindow ShowWindow 4437->4442 4438->4437 4439 40589a 4444 4058a1 GetClientRect GetSystemMetrics SendMessageW SendMessageW 4439->4444 4443 405a6f 4440->4443 4446 405a23 4440->4446 4447 405a49 ShowWindow 4440->4447 4448 40462b 8 API calls 4441->4448 4480 4045f9 SendMessageW 4442->4480 4443->4441 4453 405a7d SendMessageW 4443->4453 4451 4058f3 SendMessageW SendMessageW 4444->4451 4452 40590f 4444->4452 4454 40459d SendMessageW 4446->4454 4449 405a69 4447->4449 4450 405a5b 4447->4450 4459 405a42 4448->4459 4456 40459d SendMessageW 4449->4456 4455 4056ca 24 API calls 4450->4455 4451->4452 4457 405922 4452->4457 4458 405914 SendMessageW 4452->4458 4453->4459 4460 405a96 CreatePopupMenu 4453->4460 4454->4441 4455->4449 4456->4443 4462 4045c4 18 API calls 4457->4462 4458->4457 4461 4066a5 17 API calls 4460->4461 4463 405aa6 AppendMenuW 4461->4463 4464 405932 4462->4464 4465 405ac3 GetWindowRect 4463->4465 4466 405ad6 TrackPopupMenu 4463->4466 4467 40593b ShowWindow 4464->4467 4468 40596f GetDlgItem SendMessageW 4464->4468 4465->4466 4466->4459 4470 405af1 4466->4470 4471 405951 ShowWindow 4467->4471 4472 40595e 4467->4472 4468->4459 4469 405996 SendMessageW SendMessageW 4468->4469 4469->4459 4473 405b0d SendMessageW 4470->4473 4471->4472 4479 4045f9 SendMessageW 4472->4479 4473->4473 4474 405b2a OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 4473->4474 4476 405b4f SendMessageW 4474->4476 4476->4476 4477 405b78 GlobalUnlock SetClipboardData CloseClipboard 4476->4477 4477->4459 4478->4439 4479->4468 4480->4440 3794 40248a 3795 402da6 17 API calls 3794->3795 3796 40249c 3795->3796 3797 402da6 17 API calls 3796->3797 3798 4024a6 3797->3798 3811 402e36 3798->3811 3801 40292e 3802 4024de 3804 4024ea 3802->3804 3815 402d84 3802->3815 3803 402da6 17 API calls 3805 4024d4 lstrlenW 3803->3805 3807 402509 RegSetValueExW 3804->3807 3808 403371 44 API calls 3804->3808 3805->3802 3809 40251f RegCloseKey 3807->3809 3808->3807 3809->3801 3812 402e51 3811->3812 3818 406503 3812->3818 3816 4066a5 17 API calls 3815->3816 3817 402d99 3816->3817 3817->3804 3819 406512 3818->3819 3820 4024b6 3819->3820 3821 40651d RegCreateKeyExW 3819->3821 3820->3801 3820->3802 3820->3803 3821->3820 4481 404e0b 4482 404e37 4481->4482 4483 404e1b 4481->4483 4485 404e6a 4482->4485 4486 404e3d SHGetPathFromIDListW 4482->4486 4492 405cac GetDlgItemTextW 4483->4492 4487 404e54 SendMessageW 4486->4487 4488 404e4d 4486->4488 4487->4485 4490 40140b 2 API calls 4488->4490 4489 404e28 SendMessageW 4489->4482 4490->4487 4492->4489 4493 40290b 4494 402da6 17 API calls 4493->4494 4495 402912 FindFirstFileW 4494->4495 4496 40293a 4495->4496 4500 402925 4495->4500 4501 4065af wsprintfW 4496->4501 4498 402943 4502 406668 lstrcpynW 4498->4502 4501->4498 4502->4500 4503 40190c 4504 401943 4503->4504 4505 402da6 17 API calls 4504->4505 4506 401948 4505->4506 4507 405d74 67 API calls 4506->4507 4508 401951 4507->4508 4509 40190f 4510 402da6 17 API calls 4509->4510 4511 401916 4510->4511 4512 405cc8 MessageBoxIndirectW 4511->4512 4513 40191f 4512->4513 4514 401491 4515 4056ca 24 API calls 4514->4515 4516 401498 4515->4516 4517 402891 4518 402898 4517->4518 4519 402ba9 4517->4519 4520 402d84 17 API calls 4518->4520 4521 40289f 4520->4521 4522 4028ae SetFilePointer 4521->4522 4522->4519 4523 4028be 4522->4523 4525 4065af wsprintfW 4523->4525 4525->4519 4526 401f12 4527 402da6 17 API calls 4526->4527 4528 401f18 4527->4528 4529 402da6 17 API calls 4528->4529 4530 401f21 4529->4530 4531 402da6 17 API calls 4530->4531 4532 401f2a 4531->4532 4533 402da6 17 API calls 4532->4533 4534 401f33 4533->4534 4535 401423 24 API calls 4534->4535 4536 401f3a 4535->4536 4543 405c8e ShellExecuteExW 4536->4543 4538 401f82 4539 406ae0 5 API calls 4538->4539 4541 40292e 4538->4541 4540 401f9f CloseHandle 4539->4540 4540->4541 4543->4538 4544 402f93 4545 402fa5 SetTimer 4544->4545 4546 402fbe 4544->4546 4545->4546 4547 40300c 4546->4547 4548 403012 MulDiv 4546->4548 4549 402fcc wsprintfW SetWindowTextW SetDlgItemTextW 4548->4549 4549->4547 4565 401d17 4566 402d84 17 API calls 4565->4566 4567 401d1d IsWindow 4566->4567 4568 401a20 4567->4568 3952 401b9b 3953 401ba8 3952->3953 3954 401bec 3952->3954 3961 401bbf 3953->3961 3963 401c31 3953->3963 3955 401bf1 3954->3955 3956 401c16 GlobalAlloc 3954->3956 3960 40239d 3955->3960 3971 406668 lstrcpynW 3955->3971 3958 4066a5 17 API calls 3956->3958 3957 4066a5 17 API calls 3959 402397 3957->3959 3958->3963 3967 405cc8 MessageBoxIndirectW 3959->3967 3972 406668 lstrcpynW 3961->3972 3963->3957 3963->3960 3965 401c03 GlobalFree 3965->3960 3966 401bce 3973 406668 lstrcpynW 3966->3973 3967->3960 3969 401bdd 3974 406668 lstrcpynW 3969->3974 3971->3965 3972->3966 3973->3969 3974->3960 4569 40261c 4570 402da6 17 API calls 4569->4570 4571 402623 4570->4571 4574 406158 GetFileAttributesW CreateFileW 4571->4574 4573 40262f 4574->4573 3981 40259e 3982 402de6 17 API calls 3981->3982 3983 4025a8 3982->3983 3984 402d84 17 API calls 3983->3984 3985 4025b1 3984->3985 3986 40292e 3985->3986 3987 4025d9 RegEnumValueW 3985->3987 3988 4025cd RegEnumKeyW 3985->3988 3989 4025ee 3987->3989 3990 4025f5 RegCloseKey 3987->3990 3988->3990 3989->3990 3990->3986 4582 40149e 4583 4014ac PostQuitMessage 4582->4583 4584 40239d 4582->4584 4583->4584 4585 4015a3 4586 402da6 17 API calls 4585->4586 4587 4015aa SetFileAttributesW 4586->4587 4588 4015bc 4587->4588 3756 401fa4 3757 402da6 17 API calls 3756->3757 3758 401faa 3757->3758 3759 4056ca 24 API calls 3758->3759 3760 401fb4 3759->3760 3761 405c4b 2 API calls 3760->3761 3762 401fba 3761->3762 3763 401fdd CloseHandle 3762->3763 3767 40292e 3762->3767 3771 406ae0 WaitForSingleObject 3762->3771 3763->3767 3766 401fcf 3768 401fd4 3766->3768 3769 401fdf 3766->3769 3776 4065af wsprintfW 3768->3776 3769->3763 3772 406afa 3771->3772 3773 406b0c GetExitCodeProcess 3772->3773 3774 406a71 2 API calls 3772->3774 3773->3766 3775 406b01 WaitForSingleObject 3774->3775 3775->3772 3776->3763 3777 403c25 3778 403c40 3777->3778 3779 403c36 CloseHandle 3777->3779 3780 403c54 3778->3780 3781 403c4a CloseHandle 3778->3781 3779->3778 3786 403c82 3780->3786 3781->3780 3784 405d74 67 API calls 3785 403c65 3784->3785 3787 403c90 3786->3787 3788 403c59 3787->3788 3789 403c95 FreeLibrary GlobalFree 3787->3789 3788->3784 3789->3788 3789->3789 3822 40252a 3833 402de6 3822->3833 3825 402da6 17 API calls 3826 40253d 3825->3826 3827 402548 RegQueryValueExW 3826->3827 3831 40292e 3826->3831 3828 40256e RegCloseKey 3827->3828 3829 402568 3827->3829 3828->3831 3829->3828 3838 4065af wsprintfW 3829->3838 3834 402da6 17 API calls 3833->3834 3835 402dfd 3834->3835 3836 4064d5 RegOpenKeyExW 3835->3836 3837 402534 3836->3837 3837->3825 3838->3828 3839 4021aa 3840 402da6 17 API calls 3839->3840 3841 4021b1 3840->3841 3842 402da6 17 API calls 3841->3842 3843 4021bb 3842->3843 3844 402da6 17 API calls 3843->3844 3845 4021c5 3844->3845 3846 402da6 17 API calls 3845->3846 3847 4021cf 3846->3847 3848 402da6 17 API calls 3847->3848 3849 4021d9 3848->3849 3850 402218 CoCreateInstance 3849->3850 3851 402da6 17 API calls 3849->3851 3854 402237 3850->3854 3851->3850 3852 401423 24 API calls 3853 4022f6 3852->3853 3854->3852 3854->3853 4589 40202a 4590 402da6 17 API calls 4589->4590 4591 402031 4590->4591 4592 406a35 5 API calls 4591->4592 4593 402040 4592->4593 4594 4020cc 4593->4594 4595 40205c GlobalAlloc 4593->4595 4595->4594 4596 402070 4595->4596 4597 406a35 5 API calls 4596->4597 4598 402077 4597->4598 4599 406a35 5 API calls 4598->4599 4600 402081 4599->4600 4600->4594 4604 4065af wsprintfW 4600->4604 4602 4020ba 4605 4065af wsprintfW 4602->4605 4604->4602 4605->4594 4613 401a30 4614 402da6 17 API calls 4613->4614 4615 401a39 ExpandEnvironmentStringsW 4614->4615 4616 401a60 4615->4616 4617 401a4d 4615->4617 4617->4616 4618 401a52 lstrcmpW 4617->4618 4618->4616 4619 405031 GetDlgItem GetDlgItem 4620 405083 7 API calls 4619->4620 4621 4052a8 4619->4621 4622 40512a DeleteObject 4620->4622 4623 40511d SendMessageW 4620->4623 4626 40538a 4621->4626 4653 405317 4621->4653 4673 404f7f SendMessageW 4621->4673 4624 405133 4622->4624 4623->4622 4625 40516a 4624->4625 4629 4066a5 17 API calls 4624->4629 4627 4045c4 18 API calls 4625->4627 4628 405436 4626->4628 4632 40529b 4626->4632 4638 4053e3 SendMessageW 4626->4638 4631 40517e 4627->4631 4633 405440 SendMessageW 4628->4633 4634 405448 4628->4634 4630 40514c SendMessageW SendMessageW 4629->4630 4630->4624 4637 4045c4 18 API calls 4631->4637 4635 40462b 8 API calls 4632->4635 4633->4634 4641 405461 4634->4641 4642 40545a ImageList_Destroy 4634->4642 4649 405471 4634->4649 4640 405637 4635->4640 4654 40518f 4637->4654 4638->4632 4644 4053f8 SendMessageW 4638->4644 4639 40537c SendMessageW 4639->4626 4645 40546a GlobalFree 4641->4645 4641->4649 4642->4641 4643 4055eb 4643->4632 4650 4055fd ShowWindow GetDlgItem ShowWindow 4643->4650 4647 40540b 4644->4647 4645->4649 4646 40526a GetWindowLongW SetWindowLongW 4648 405283 4646->4648 4658 40541c SendMessageW 4647->4658 4651 4052a0 4648->4651 4652 405288 ShowWindow 4648->4652 4649->4643 4666 4054ac 4649->4666 4678 404fff 4649->4678 4650->4632 4672 4045f9 SendMessageW 4651->4672 4671 4045f9 SendMessageW 4652->4671 4653->4626 4653->4639 4654->4646 4657 4051e2 SendMessageW 4654->4657 4659 405265 4654->4659 4660 405220 SendMessageW 4654->4660 4661 405234 SendMessageW 4654->4661 4657->4654 4658->4628 4659->4646 4659->4648 4660->4654 4661->4654 4663 4055b6 4664 4055c1 InvalidateRect 4663->4664 4667 4055cd 4663->4667 4664->4667 4665 4054da SendMessageW 4669 4054f0 4665->4669 4666->4665 4666->4669 4667->4643 4687 404f3a 4667->4687 4668 405564 SendMessageW SendMessageW 4668->4669 4669->4663 4669->4668 4671->4632 4672->4621 4674 404fa2 GetMessagePos ScreenToClient SendMessageW 4673->4674 4675 404fde SendMessageW 4673->4675 4676 404fd6 4674->4676 4677 404fdb 4674->4677 4675->4676 4676->4653 4677->4675 4690 406668 lstrcpynW 4678->4690 4680 405012 4691 4065af wsprintfW 4680->4691 4682 40501c 4683 40140b 2 API calls 4682->4683 4684 405025 4683->4684 4692 406668 lstrcpynW 4684->4692 4686 40502c 4686->4666 4693 404e71 4687->4693 4689 404f4f 4689->4643 4690->4680 4691->4682 4692->4686 4694 404e8a 4693->4694 4695 4066a5 17 API calls 4694->4695 4696 404eee 4695->4696 4697 4066a5 17 API calls 4696->4697 4698 404ef9 4697->4698 4699 4066a5 17 API calls 4698->4699 4700 404f0f lstrlenW wsprintfW SetDlgItemTextW 4699->4700 4700->4689 4706 4023b2 4707 4023ba 4706->4707 4710 4023c0 4706->4710 4708 402da6 17 API calls 4707->4708 4708->4710 4709 4023ce 4712 4023dc 4709->4712 4713 402da6 17 API calls 4709->4713 4710->4709 4711 402da6 17 API calls 4710->4711 4711->4709 4714 402da6 17 API calls 4712->4714 4713->4712 4715 4023e5 WritePrivateProfileStringW 4714->4715 4716 404734 lstrlenW 4717 404753 4716->4717 4718 404755 WideCharToMultiByte 4716->4718 4717->4718 4719 402434 4720 402467 4719->4720 4721 40243c 4719->4721 4723 402da6 17 API calls 4720->4723 4722 402de6 17 API calls 4721->4722 4724 402443 4722->4724 4725 40246e 4723->4725 4727 402da6 17 API calls 4724->4727 4729 40247b 4724->4729 4730 402e64 4725->4730 4728 402454 RegDeleteValueW RegCloseKey 4727->4728 4728->4729 4731 402e78 4730->4731 4733 402e71 4730->4733 4731->4733 4734 402ea9 4731->4734 4733->4729 4735 4064d5 RegOpenKeyExW 4734->4735 4736 402ed7 4735->4736 4737 402ee7 RegEnumValueW 4736->4737 4744 402f81 4736->4744 4746 402f0a 4736->4746 4738 402f71 RegCloseKey 4737->4738 4737->4746 4738->4744 4739 402f46 RegEnumKeyW 4740 402f4f RegCloseKey 4739->4740 4739->4746 4741 406a35 5 API calls 4740->4741 4742 402f5f 4741->4742 4742->4744 4745 402f63 RegDeleteKeyW 4742->4745 4743 402ea9 6 API calls 4743->4746 4744->4733 4745->4744 4746->4738 4746->4739 4746->4740 4746->4743 4747 401735 4748 402da6 17 API calls 4747->4748 4749 40173c SearchPathW 4748->4749 4750 401757 4749->4750 4751 404ab5 4752 404ae1 4751->4752 4753 404af2 4751->4753 4812 405cac GetDlgItemTextW 4752->4812 4755 404afe GetDlgItem 4753->4755 4760 404b5d 4753->4760 4758 404b12 4755->4758 4756 404c41 4761 404df0 4756->4761 4814 405cac GetDlgItemTextW 4756->4814 4757 404aec 4759 4068ef 5 API calls 4757->4759 4763 404b26 SetWindowTextW 4758->4763 4764 405fe2 4 API calls 4758->4764 4759->4753 4760->4756 4760->4761 4765 4066a5 17 API calls 4760->4765 4768 40462b 8 API calls 4761->4768 4767 4045c4 18 API calls 4763->4767 4769 404b1c 4764->4769 4770 404bd1 SHBrowseForFolderW 4765->4770 4766 404c71 4771 40603f 18 API calls 4766->4771 4772 404b42 4767->4772 4773 404e04 4768->4773 4769->4763 4777 405f37 3 API calls 4769->4777 4770->4756 4774 404be9 CoTaskMemFree 4770->4774 4775 404c77 4771->4775 4776 4045c4 18 API calls 4772->4776 4778 405f37 3 API calls 4774->4778 4815 406668 lstrcpynW 4775->4815 4779 404b50 4776->4779 4777->4763 4780 404bf6 4778->4780 4813 4045f9 SendMessageW 4779->4813 4783 404c2d SetDlgItemTextW 4780->4783 4788 4066a5 17 API calls 4780->4788 4783->4756 4784 404b56 4786 406a35 5 API calls 4784->4786 4785 404c8e 4787 406a35 5 API calls 4785->4787 4786->4760 4794 404c95 4787->4794 4789 404c15 lstrcmpiW 4788->4789 4789->4783 4792 404c26 lstrcatW 4789->4792 4790 404cd6 4816 406668 lstrcpynW 4790->4816 4792->4783 4793 404cdd 4795 405fe2 4 API calls 4793->4795 4794->4790 4798 405f83 2 API calls 4794->4798 4800 404d2e 4794->4800 4796 404ce3 GetDiskFreeSpaceW 4795->4796 4799 404d07 MulDiv 4796->4799 4796->4800 4798->4794 4799->4800 4802 404f3a 20 API calls 4800->4802 4810 404d9f 4800->4810 4801 404dc2 4817 4045e6 EnableWindow 4801->4817 4804 404d8c 4802->4804 4803 40140b 2 API calls 4803->4801 4806 404da1 SetDlgItemTextW 4804->4806 4807 404d91 4804->4807 4806->4810 4808 404e71 20 API calls 4807->4808 4808->4810 4809 404dde 4809->4761 4811 404a0e SendMessageW 4809->4811 4810->4801 4810->4803 4811->4761 4812->4757 4813->4784 4814->4766 4815->4785 4816->4793 4817->4809 4818 401d38 4819 402d84 17 API calls 4818->4819 4820 401d3f 4819->4820 4821 402d84 17 API calls 4820->4821 4822 401d4b GetDlgItem 4821->4822 4823 402638 4822->4823 4824 4014b8 4825 4014be 4824->4825 4826 401389 2 API calls 4825->4826 4827 4014c6 4826->4827 4828 40563e 4829 405662 4828->4829 4830 40564e 4828->4830 4833 40566a IsWindowVisible 4829->4833 4839 405681 4829->4839 4831 405654 4830->4831 4832 4056ab 4830->4832 4835 404610 SendMessageW 4831->4835 4834 4056b0 CallWindowProcW 4832->4834 4833->4832 4836 405677 4833->4836 4837 40565e 4834->4837 4835->4837 4838 404f7f 5 API calls 4836->4838 4838->4839 4839->4834 4840 404fff 4 API calls 4839->4840 4840->4832 4841 40263e 4842 402652 4841->4842 4843 40266d 4841->4843 4844 402d84 17 API calls 4842->4844 4845 402672 4843->4845 4846 40269d 4843->4846 4855 402659 4844->4855 4848 402da6 17 API calls 4845->4848 4847 402da6 17 API calls 4846->4847 4850 4026a4 lstrlenW 4847->4850 4849 402679 4848->4849 4858 40668a WideCharToMultiByte 4849->4858 4850->4855 4852 40268d lstrlenA 4852->4855 4853 4026e7 4854 4026d1 4854->4853 4856 40620a WriteFile 4854->4856 4855->4853 4855->4854 4857 406239 5 API calls 4855->4857 4856->4853 4857->4854 4858->4852

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 00403640 Relevance: 93.2, APIs: 34, Strings: 19, Instructions: 450stringfilecomCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 0 403640-403690 SetErrorMode GetVersionExW 1 403692-4036c6 GetVersionExW 0->1 2 4036ca-4036d1 0->2 1->2 3 4036d3 2->3 4 4036db-40371b 2->4 3->4 5 40371d-403725 call 406a35 4->5 6 40372e 4->6 5->6 11 403727 5->11 8 403733-403747 call 4069c5 lstrlenA 6->8 13 403749-403765 call 406a35 * 3 8->13 11->6 20 403776-4037d8 #17 OleInitialize SHGetFileInfoW call 406668 GetCommandLineW call 406668 13->20 21 403767-40376d 13->21 28 4037e1-4037f4 call 405f64 CharNextW 20->28 29 4037da-4037dc 20->29 21->20 25 40376f 21->25 25->20 32 4038eb-4038f1 28->32 29->28 33 4038f7 32->33 34 4037f9-4037ff 32->34 37 40390b-403925 GetTempPathW call 40360f 33->37 35 403801-403806 34->35 36 403808-40380e 34->36 35->35 35->36 38 403810-403814 36->38 39 403815-403819 36->39 47 403927-403945 GetWindowsDirectoryW lstrcatW call 40360f 37->47 48 40397d-403995 DeleteFileW call 4030d0 37->48 38->39 41 4038d9-4038e7 call 405f64 39->41 42 40381f-403825 39->42 41->32 58 4038e9-4038ea 41->58 45 403827-40382e 42->45 46 40383f-403878 42->46 51 403830-403833 45->51 52 403835 45->52 53 403894-4038ce 46->53 54 40387a-40387f 46->54 47->48 62 403947-403977 GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 40360f 47->62 64 40399b-4039a1 48->64 65 403b6c-403b7a ExitProcess CoUninitialize 48->65 51->46 51->52 52->46 56 4038d0-4038d4 53->56 57 4038d6-4038d8 53->57 54->53 60 403881-403889 54->60 56->57 63 4038f9-403906 call 406668 56->63 57->41 58->32 66 403890 60->66 67 40388b-40388e 60->67 62->48 62->65 63->37 69 4039a7-4039ba call 405f64 64->69 70 403a48-403a4f call 403d17 64->70 72 403b91-403b97 65->72 73 403b7c-403b8b call 405cc8 ExitProcess 65->73 66->53 67->53 67->66 88 403a0c-403a19 69->88 89 4039bc-4039f1 69->89 83 403a54-403a57 70->83 74 403b99-403bae GetCurrentProcess OpenProcessToken 72->74 75 403c0f-403c17 72->75 80 403bb0-403bd9 LookupPrivilegeValueW AdjustTokenPrivileges 74->80 81 403bdf-403bed call 406a35 74->81 84 403c19 75->84 85 403c1c-403c1f ExitProcess 75->85 80->81 95 403bfb-403c06 ExitWindowsEx 81->95 96 403bef-403bf9 81->96 83->65 84->85 90 403a1b-403a29 call 40603f 88->90 91 403a5c-403a70 call 405c33 lstrcatW 88->91 93 4039f3-4039f7 89->93 90->65 104 403a2f-403a45 call 406668 * 2 90->104 107 403a72-403a78 lstrcatW 91->107 108 403a7d-403a97 lstrcatW lstrcmpiW 91->108 98 403a00-403a08 93->98 99 4039f9-4039fe 93->99 95->75 101 403c08-403c0a call 40140b 95->101 96->95 96->101 98->93 103 403a0a 98->103 99->98 99->103 101->75 103->88 104->70 107->108 109 403b6a 108->109 110 403a9d-403aa0 108->110 109->65 112 403aa2-403aa7 call 405b99 110->112 113 403aa9 call 405c16 110->113 119 403aae-403abe SetCurrentDirectoryW 112->119 113->119 121 403ac0-403ac6 call 406668 119->121 122 403acb-403af7 call 406668 119->122 121->122 126 403afc-403b17 call 4066a5 DeleteFileW 122->126 129 403b57-403b61 126->129 130 403b19-403b29 CopyFileW 126->130 129->126 132 403b63-403b65 call 406428 129->132 130->129 131 403b2b-403b4b call 406428 call 4066a5 call 405c4b 130->131 131->129 140 403b4d-403b54 CloseHandle 131->140 132->109 140->129
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetErrorMode.KERNEL32(00008001), ref: 00403663
                                                                                                                                                                                      • GetVersionExW.KERNEL32(?), ref: 0040368C
                                                                                                                                                                                      • GetVersionExW.KERNEL32(0000011C), ref: 004036A3
                                                                                                                                                                                      • lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373A
                                                                                                                                                                                      • #17.COMCTL32(00000007,00000009,0000000B), ref: 00403776
                                                                                                                                                                                      • OleInitialize.OLE32(00000000), ref: 0040377D
                                                                                                                                                                                      • SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 0040379B
                                                                                                                                                                                      • GetCommandLineW.KERNEL32(00429260,NSIS Error), ref: 004037B0
                                                                                                                                                                                      • CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000020,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000000), ref: 004037E9
                                                                                                                                                                                      • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 0040391C
                                                                                                                                                                                      • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040392D
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403939
                                                                                                                                                                                      • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040394D
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403955
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403966
                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040396E
                                                                                                                                                                                      • DeleteFileW.KERNEL32(1033), ref: 00403982
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000000,?), ref: 00403A69
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000000,?), ref: 00403A78
                                                                                                                                                                                        • Part of subcall function 00405C16: CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000000,?), ref: 00403A83
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force,00000000,?), ref: 00403A8F
                                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403AAF
                                                                                                                                                                                      • DeleteFileW.KERNEL32(00420F08,00420F08,?,5445468,?), ref: 00403B0E
                                                                                                                                                                                      • CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq4808.tmp,00420F08,00000001), ref: 00403B21
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000), ref: 00403B4E
                                                                                                                                                                                      • ExitProcess.KERNEL32(?), ref: 00403B6C
                                                                                                                                                                                      • CoUninitialize.COMBASE(?), ref: 00403B71
                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403B8B
                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(00000028,?), ref: 00403B9F
                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(00000000), ref: 00403BA6
                                                                                                                                                                                      • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403BBA
                                                                                                                                                                                      • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403BD9
                                                                                                                                                                                      • ExitWindowsEx.USER32(00000002,80040002), ref: 00403BFE
                                                                                                                                                                                      • ExitProcess.KERNEL32 ref: 00403C1F
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Processlstrcat$ExitFile$Directory$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
                                                                                                                                                                                      • String ID: "C:\Users\user\AppData\Local\Temp\nsq4808.tmp" /internal 1730271248380473 /force$.tmp$1033$5445468$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsq4808.tmp$C:\Users\user\PCAppStore$C:\Users\user\PCAppStore$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
                                                                                                                                                                                      • API String ID: 2292928366-183771286
                                                                                                                                                                                      • Opcode ID: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                      • Instruction ID: d56582c8b11bee4b9d4e83ad1f604629a9588d533935b381636b20c84fba3529
                                                                                                                                                                                      • Opcode Fuzzy Hash: 54eba713b65b488fe05b557adb658f0301d1077f312d6d7219dab3d109336353
                                                                                                                                                                                      • Instruction Fuzzy Hash: D4E1F471A00214AADB20AFB58D45A6E3EB8EB05709F50847FF945B32D1DB7C8A41CB6D
                                                                                                                                                                                      Function 00405D74 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 346 405d74-405d9a call 40603f 349 405db3-405dba 346->349 350 405d9c-405dae DeleteFileW 346->350 352 405dbc-405dbe 349->352 353 405dcd-405ddd call 406668 349->353 351 405f30-405f34 350->351 354 405dc4-405dc7 352->354 355 405ede-405ee3 352->355 361 405dec-405ded call 405f83 353->361 362 405ddf-405dea lstrcatW 353->362 354->353 354->355 355->351 357 405ee5-405ee8 355->357 359 405ef2-405efa call 40699e 357->359 360 405eea-405ef0 357->360 359->351 370 405efc-405f10 call 405f37 call 405d2c 359->370 360->351 365 405df2-405df6 361->365 362->365 366 405e02-405e08 lstrcatW 365->366 367 405df8-405e00 365->367 369 405e0d-405e29 lstrlenW FindFirstFileW 366->369 367->366 367->369 371 405ed3-405ed7 369->371 372 405e2f-405e37 369->372 386 405f12-405f15 370->386 387 405f28-405f2b call 4056ca 370->387 371->355 377 405ed9 371->377 374 405e57-405e6b call 406668 372->374 375 405e39-405e41 372->375 388 405e82-405e8d call 405d2c 374->388 389 405e6d-405e75 374->389 378 405e43-405e4b 375->378 379 405eb6-405ec6 FindNextFileW 375->379 377->355 378->374 382 405e4d-405e55 378->382 379->372 385 405ecc-405ecd FindClose 379->385 382->374 382->379 385->371 386->360 392 405f17-405f26 call 4056ca call 406428 386->392 387->351 397 405eae-405eb1 call 4056ca 388->397 398 405e8f-405e92 388->398 389->379 393 405e77-405e80 call 405d74 389->393 392->351 393->379 397->379 401 405e94-405ea4 call 4056ca call 406428 398->401 402 405ea6-405eac 398->402 401->379 402->379
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,?,74DF3420,74DF2EE0,00000000), ref: 00405D9D
                                                                                                                                                                                      • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405DE5
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E08
                                                                                                                                                                                      • lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E0E
                                                                                                                                                                                      • FindFirstFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405E1E
                                                                                                                                                                                      • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405EBE
                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 00405ECD
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                      • String ID: .$.$C:\Users\user\AppData\Local\Temp\nsj906B.tmp\*.*$\*.*
                                                                                                                                                                                      • API String ID: 2035342205-2006221800
                                                                                                                                                                                      • Opcode ID: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                      • Instruction ID: 3801e3340fbbb9c460ab277ab089a7ece50ce31247a5b640c745bca9484d7288
                                                                                                                                                                                      • Opcode Fuzzy Hash: eb4081a649fdbb44c8907daec76b44e1c805ca5b036c6d0867ef95af4715127c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 46410330800A15AADB21AB61CC49BBF7678EF41715F50413FF881711D1DB7C4A82CEAE
                                                                                                                                                                                      Function 00406D5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 566 406d5f-406d64 567 406dd5-406df3 566->567 568 406d66-406d95 566->568 569 4073cb-4073e0 567->569 570 406d97-406d9a 568->570 571 406d9c-406da0 568->571 572 4073e2-4073f8 569->572 573 4073fa-407410 569->573 574 406dac-406daf 570->574 575 406da2-406da6 571->575 576 406da8 571->576 577 407413-40741a 572->577 573->577 578 406db1-406dba 574->578 579 406dcd-406dd0 574->579 575->574 576->574 583 407441-40744d 577->583 584 40741c-407420 577->584 580 406dbc 578->580 581 406dbf-406dcb 578->581 582 406fa2-406fc0 579->582 580->581 585 406e35-406e63 581->585 589 406fc2-406fd6 582->589 590 406fd8-406fea 582->590 592 406be3-406bec 583->592 586 407426-40743e 584->586 587 4075cf-4075d9 584->587 593 406e65-406e7d 585->593 594 406e7f-406e99 585->594 586->583 591 4075e5-4075f8 587->591 595 406fed-406ff7 589->595 590->595 599 4075fd-407601 591->599 596 406bf2 592->596 597 4075fa 592->597 598 406e9c-406ea6 593->598 594->598 600 406ff9 595->600 601 406f9a-406fa0 595->601 603 406bf9-406bfd 596->603 604 406d39-406d5a 596->604 605 406c9e-406ca2 596->605 606 406d0e-406d12 596->606 597->599 608 406eac 598->608 609 406e1d-406e23 598->609 617 407581-40758b 600->617 618 406f7f-406f97 600->618 601->582 607 406f3e-406f48 601->607 603->591 610 406c03-406c10 603->610 604->569 619 406ca8-406cc1 605->619 620 40754e-407558 605->620 611 406d18-406d2c 606->611 612 40755d-407567 606->612 613 40758d-407597 607->613 614 406f4e-407117 607->614 625 406e02-406e1a 608->625 626 407569-407573 608->626 615 406ed6-406edc 609->615 616 406e29-406e2f 609->616 610->597 624 406c16-406c5c 610->624 627 406d2f-406d37 611->627 612->591 613->591 614->592 622 406f3a 615->622 623 406ede-406efc 615->623 616->585 616->622 617->591 618->601 629 406cc4-406cc8 619->629 620->591 622->607 630 406f14-406f26 623->630 631 406efe-406f12 623->631 632 406c84-406c86 624->632 633 406c5e-406c62 624->633 625->609 626->591 627->604 627->606 629->605 634 406cca-406cd0 629->634 637 406f29-406f33 630->637 631->637 640 406c94-406c9c 632->640 641 406c88-406c92 632->641 638 406c64-406c67 GlobalFree 633->638 639 406c6d-406c7b GlobalAlloc 633->639 635 406cd2-406cd9 634->635 636 406cfa-406d0c 634->636 642 406ce4-406cf4 GlobalAlloc 635->642 643 406cdb-406cde GlobalFree 635->643 636->627 637->615 644 406f35 637->644 638->639 639->597 645 406c81 639->645 640->629 641->640 641->641 642->597 642->636 643->642 647 407575-40757f 644->647 648 406ebb-406ed3 644->648 645->632 647->591 648->615
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                      • Instruction ID: 02c1e40b0c9780dd067322b7733c474732bd0f187a49f53fd7fd3c108ee94619
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ae840c17bc4cb012e3c6e2f9739eb08ea49decd14d2b7f73774d31e5ba5825a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7CF15570D04229CBDF28CFA8C8946ADBBB0FF44305F24816ED456BB281D7386A86DF45
                                                                                                                                                                                      Function 0040699E Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FindFirstFileW.KERNEL32(74DF3420,00426798,00425F50,00406088,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004069A9
                                                                                                                                                                                      • FindClose.KERNEL32(00000000), ref: 004069B5
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                                      • Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                      • Instruction ID: 0ca7534fdffec89160a31ceabb6ef5ff718bfc83d1618d69d17f9e635378cbc3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5ED012B15192205FC34057387E0C84B7A989F563317268A36B4AAF11E0CB348C3297AC
                                                                                                                                                                                      Function 00403D17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 141 403d17-403d2f call 406a35 144 403d31-403d41 call 4065af 141->144 145 403d43-403d7a call 406536 141->145 154 403d9d-403dc6 call 403fed call 40603f 144->154 150 403d92-403d98 lstrcatW 145->150 151 403d7c-403d8d call 406536 145->151 150->154 151->150 159 403e58-403e60 call 40603f 154->159 160 403dcc-403dd1 154->160 166 403e62-403e69 call 4066a5 159->166 167 403e6e-403e93 LoadImageW 159->167 160->159 162 403dd7-403dff call 406536 160->162 162->159 168 403e01-403e05 162->168 166->167 170 403f14-403f1c call 40140b 167->170 171 403e95-403ec5 RegisterClassW 167->171 172 403e17-403e23 lstrlenW 168->172 173 403e07-403e14 call 405f64 168->173 184 403f26-403f31 call 403fed 170->184 185 403f1e-403f21 170->185 174 403fe3 171->174 175 403ecb-403f0f SystemParametersInfoW CreateWindowExW 171->175 179 403e25-403e33 lstrcmpiW 172->179 180 403e4b-403e53 call 405f37 call 406668 172->180 173->172 178 403fe5-403fec 174->178 175->170 179->180 183 403e35-403e3f GetFileAttributesW 179->183 180->159 187 403e41-403e43 183->187 188 403e45-403e46 call 405f83 183->188 194 403f37-403f51 ShowWindow call 4069c5 184->194 195 403fba-403fc2 call 40579d 184->195 185->178 187->180 187->188 188->180 200 403f53-403f58 call 4069c5 194->200 201 403f5d-403f6f GetClassInfoW 194->201 202 403fc4-403fca 195->202 203 403fdc-403fde call 40140b 195->203 200->201 206 403f71-403f81 GetClassInfoW RegisterClassW 201->206 207 403f87-403fb8 DialogBoxParamW call 40140b call 403c67 201->207 202->185 208 403fd0-403fd7 call 40140b 202->208 203->174 206->207 207->178 208->185
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00406A35: GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                        • Part of subcall function 00406A35: GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                      • lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403D98
                                                                                                                                                                                      • lstrlenW.KERNEL32(get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,74DF3420), ref: 00403E18
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(?,.exe,get,?,?,?,get,00000000,C:\Users\user\PCAppStore,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403E2B
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(get,?,00000000,?), ref: 00403E36
                                                                                                                                                                                      • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\PCAppStore), ref: 00403E7F
                                                                                                                                                                                        • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                      • RegisterClassW.USER32(00429200), ref: 00403EBC
                                                                                                                                                                                      • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ED4
                                                                                                                                                                                      • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403F09
                                                                                                                                                                                      • ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403F3F
                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403F6B
                                                                                                                                                                                      • GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403F78
                                                                                                                                                                                      • RegisterClassW.USER32(00429200), ref: 00403F81
                                                                                                                                                                                      • DialogBoxParamW.USER32(?,00000000,004040C5,00000000), ref: 00403FA0
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                      • String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\PCAppStore$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$get
                                                                                                                                                                                      • API String ID: 1975747703-284748347
                                                                                                                                                                                      • Opcode ID: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                      • Instruction ID: e235badc60aeba35c86cf297cd954ec43a22164425911800af60bc979c7621a1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 78a63079156de9a95659751e2075cee6996798d0e51b0c114acce594fd97feca
                                                                                                                                                                                      • Instruction Fuzzy Hash: E661D570640201BAD730AF66AD45E2B3A7CEB84B49F40457FF945B22E1DB3D5911CA3D
                                                                                                                                                                                      Function 004030D0 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 204memoryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 215 4030d0-40311e GetTickCount GetModuleFileNameW call 406158 218 403120-403125 215->218 219 40312a-403158 call 406668 call 405f83 call 406668 GetFileSize 215->219 220 40336a-40336e 218->220 227 403243-403251 call 40302e 219->227 228 40315e 219->228 234 403322-403327 227->234 235 403257-40325a 227->235 230 403163-40317a 228->230 232 40317c 230->232 233 40317e-403187 call 4035e2 230->233 232->233 241 40318d-403194 233->241 242 4032de-4032e6 call 40302e 233->242 234->220 237 403286-4032d2 GlobalAlloc call 406b90 call 406187 CreateFileW 235->237 238 40325c-403274 call 4035f8 call 4035e2 235->238 266 4032d4-4032d9 237->266 267 4032e8-403318 call 4035f8 call 403371 237->267 238->234 261 40327a-403280 238->261 246 403210-403214 241->246 247 403196-4031aa call 406113 241->247 242->234 251 403216-40321d call 40302e 246->251 252 40321e-403224 246->252 247->252 264 4031ac-4031b3 247->264 251->252 257 403233-40323b 252->257 258 403226-403230 call 406b22 252->258 257->230 265 403241 257->265 258->257 261->234 261->237 264->252 270 4031b5-4031bc 264->270 265->227 266->220 276 40331d-403320 267->276 270->252 272 4031be-4031c5 270->272 272->252 273 4031c7-4031ce 272->273 273->252 275 4031d0-4031f0 273->275 275->234 277 4031f6-4031fa 275->277 276->234 278 403329-40333a 276->278 279 403202-40320a 277->279 280 4031fc-403200 277->280 281 403342-403347 278->281 282 40333c 278->282 279->252 283 40320c-40320e 279->283 280->265 280->279 284 403348-40334e 281->284 282->281 283->252 284->284 285 403350-403368 call 406113 284->285 285->220
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 004030E4
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,00000400), ref: 00403100
                                                                                                                                                                                        • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                        • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 00403149
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?), ref: 0040328B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsq4808.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                      • API String ID: 2803837635-696420245
                                                                                                                                                                                      • Opcode ID: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                      • Instruction ID: 6a7077609e6cbe8902eef3654a796be60faa9129f620d49927b75729aeb44cd1
                                                                                                                                                                                      • Opcode Fuzzy Hash: dff409350d06ce17b221650d583fb97333c6afb1e6ebf9b4c6eec62bfd946937
                                                                                                                                                                                      • Instruction Fuzzy Hash: 74710271A40204ABDB20DFB5DD85B9E3AACAB04315F21457FF901B72D2CB789E418B6D
                                                                                                                                                                                      Function 004066A5 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196stringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 288 4066a5-4066b0 289 4066b2-4066c1 288->289 290 4066c3-4066d9 288->290 289->290 291 4066f1-4066fa 290->291 292 4066db-4066e8 290->292 294 406700 291->294 295 4068d5-4068e0 291->295 292->291 293 4066ea-4066ed 292->293 293->291 296 406705-406712 294->296 297 4068e2-4068e6 call 406668 295->297 298 4068eb-4068ec 295->298 296->295 299 406718-406721 296->299 297->298 301 4068b3 299->301 302 406727-406764 299->302 303 4068c1-4068c4 301->303 304 4068b5-4068bf 301->304 305 406857-40685c 302->305 306 40676a-406771 302->306 307 4068c6-4068cf 303->307 304->307 308 40685e-406864 305->308 309 40688f-406894 305->309 310 406773-406775 306->310 311 406776-406778 306->311 307->295 312 406702 307->312 313 406874-406880 call 406668 308->313 314 406866-406872 call 4065af 308->314 317 4068a3-4068b1 lstrlenW 309->317 318 406896-40689e call 4066a5 309->318 310->311 315 4067b5-4067b8 311->315 316 40677a-4067a1 call 406536 311->316 312->296 329 406885-40688b 313->329 314->329 319 4067c8-4067cb 315->319 320 4067ba-4067c6 GetSystemDirectoryW 315->320 333 40683e-406842 316->333 335 4067a7-4067b0 call 4066a5 316->335 317->307 318->317 326 406834-406836 319->326 327 4067cd-4067db GetWindowsDirectoryW 319->327 325 406838-40683c 320->325 325->333 334 40684f-406855 call 4068ef 325->334 326->325 332 4067dd-4067e5 326->332 327->326 329->317 331 40688d 329->331 331->334 339 4067e7-4067f0 332->339 340 4067fc-406812 SHGetSpecialFolderLocation 332->340 333->334 336 406844-40684a lstrcatW 333->336 334->317 335->325 336->334 345 4067f8-4067fa 339->345 343 406830 340->343 344 406814-40682e SHGetPathFromIDListW CoTaskMemFree 340->344 343->326 344->325 344->343 345->325 345->340
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSystemDirectoryW.KERNEL32(get,00000400), ref: 004067C0
                                                                                                                                                                                      • GetWindowsDirectoryW.KERNEL32(get,00000400,00000000,00422728,?,00405701,00422728,00000000,00000000,00000000,00000000), ref: 004067D3
                                                                                                                                                                                      • lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                      • lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Directory$SystemWindowslstrcatlstrlen
                                                                                                                                                                                      • String ID: 5445468$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$get
                                                                                                                                                                                      • API String ID: 4260037668-3586070812
                                                                                                                                                                                      • Opcode ID: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                      • Instruction ID: 414c90a3e727c3679fd522760d05a71ccfd37451a898d0680c6fb4b4ce958948
                                                                                                                                                                                      • Opcode Fuzzy Hash: a56a8a4d956183f5ceef7ff9e42496adb417aa599aaeb911d527621cdebcfcc9
                                                                                                                                                                                      • Instruction Fuzzy Hash: CD61E172A02115EBDB20AF64CD40BAA37A5EF10314F22C13EE946B62D0DB3D49A1CB5D
                                                                                                                                                                                      Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 410 40176f-401794 call 402da6 call 405fae 415 401796-40179c call 406668 410->415 416 40179e-4017b0 call 406668 call 405f37 lstrcatW 410->416 421 4017b5-4017b6 call 4068ef 415->421 416->421 425 4017bb-4017bf 421->425 426 4017c1-4017cb call 40699e 425->426 427 4017f2-4017f5 425->427 434 4017dd-4017ef 426->434 435 4017cd-4017db CompareFileTime 426->435 428 4017f7-4017f8 call 406133 427->428 429 4017fd-401819 call 406158 427->429 428->429 437 40181b-40181e 429->437 438 40188d-4018b6 call 4056ca call 403371 429->438 434->427 435->434 439 401820-40185e call 406668 * 2 call 4066a5 call 406668 call 405cc8 437->439 440 40186f-401879 call 4056ca 437->440 450 4018b8-4018bc 438->450 451 4018be-4018ca SetFileTime 438->451 439->425 472 401864-401865 439->472 452 401882-401888 440->452 450->451 454 4018d0-4018db CloseHandle 450->454 451->454 455 402c33 452->455 457 4018e1-4018e4 454->457 458 402c2a-402c2d 454->458 459 402c35-402c39 455->459 462 4018e6-4018f7 call 4066a5 lstrcatW 457->462 463 4018f9-4018fc call 4066a5 457->463 458->455 469 401901-4023a2 call 405cc8 462->469 463->469 469->458 469->459 472->452 474 401867-401868 472->474 474->440
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrcatW.KERNEL32(00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017B0
                                                                                                                                                                                      • CompareFileTime.KERNEL32(-00000014,?,get,get,00000000,00000000,get,C:\Users\user\PCAppStore,?,?,00000031), ref: 004017D5
                                                                                                                                                                                        • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                        • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsj906B.tmp$C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dll$C:\Users\user\PCAppStore$get
                                                                                                                                                                                      • API String ID: 1941528284-313221218
                                                                                                                                                                                      • Opcode ID: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                      • Instruction ID: 87dd38174d63fc88252c3cacf76d35d2aef1a13c6195c1d88e2760da23471212
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8a10f81b580edd96727de623d2cb72512ccae63576be40aac63ba19ed1c47bc7
                                                                                                                                                                                      • Instruction Fuzzy Hash: DE41B771500205BACF10BBB5CD85DAE7A75EF45328B20473FF422B21E1D63D89619A2E
                                                                                                                                                                                      Function 004069C5 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 476 4069c5-4069e5 GetSystemDirectoryW 477 4069e7 476->477 478 4069e9-4069eb 476->478 477->478 479 4069fc-4069fe 478->479 480 4069ed-4069f6 478->480 482 4069ff-406a32 wsprintfW LoadLibraryExW 479->482 480->479 481 4069f8-4069fa 480->481 481->482
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                      • String ID: %s%S.dll$UXTHEME$\
                                                                                                                                                                                      • API String ID: 2200240437-1946221925
                                                                                                                                                                                      • Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                      • Instruction ID: e2ac2e7087162e0187f8b4d6776822ec24d6e31928394cf94a41c199a4feb156
                                                                                                                                                                                      • Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3AF096B154121DA7DB14AB68DD0EF9B366CAB00705F11447EA646F20E0EB7CDA68CB98
                                                                                                                                                                                      Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 00402A06
                                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 00402A19
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2667972263-0
                                                                                                                                                                                      • Opcode ID: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                      • Instruction ID: 78b93316678d616cb595922dcd62a83f4062aa2fb33f08fb70827f98fa9650ab
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dd095c025195d1a428b75d74b89fb792f772f3b0487a4c6f2200001eeea121b
                                                                                                                                                                                      • Instruction Fuzzy Hash: E131B171D00124BBCF216FA9CE89D9EBE79AF09364F10023AF461762E1CB794D429B58
                                                                                                                                                                                      Function 00405B99 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 519 405b99-405be4 CreateDirectoryW 520 405be6-405be8 519->520 521 405bea-405bf7 GetLastError 519->521 522 405c11-405c13 520->522 521->522 523 405bf9-405c0d SetFileSecurityW 521->523 523->520 524 405c0f GetLastError 523->524 524->522
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405BF0
                                                                                                                                                                                      • SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405C05
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405C0F
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00405BBF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorLast$CreateDirectoryFileSecurity
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 3449924974-3081826266
                                                                                                                                                                                      • Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                      • Instruction ID: 886f74eda6482ab63e8fe18d08a652fea41827dc0a526659a7d7b5e138c44e4e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
                                                                                                                                                                                      • Instruction Fuzzy Hash: 95010871D04219EAEF009FA1CD44BEFBBB8EF14314F04403ADA44B6180E7789648CB99
                                                                                                                                                                                      Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 525 40248a-4024bb call 402da6 * 2 call 402e36 532 4024c1-4024cb 525->532 533 402c2a-402c39 525->533 535 4024cd-4024da call 402da6 lstrlenW 532->535 536 4024de-4024e1 532->536 535->536 539 4024e3-4024f4 call 402d84 536->539 540 4024f5-4024f8 536->540 539->540 543 402509-40251d RegSetValueExW 540->543 544 4024fa-402504 call 403371 540->544 546 402522-402603 RegCloseKey 543->546 547 40251f 543->547 544->543 546->533 550 40292e-402935 546->550 547->546 550->533
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj906B.tmp,00000023,00000011,00000002), ref: 004024D5
                                                                                                                                                                                      • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp,00000000,00000011,00000002), ref: 00402515
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseValuelstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsj906B.tmp
                                                                                                                                                                                      • API String ID: 2655323295-1407893081
                                                                                                                                                                                      • Opcode ID: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                      • Instruction ID: a516967871aadb8e7373f7254d3c24ec0cdbd982f2b4049ed7d94b0996b6da2b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0c53a365a9c608e81ef79c85193ab9a3ad89e5c6fa2fbf23b50052b3995ee250
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4011AF71E00108BEEF10AFA1CE49EAEB6B8EB44354F11443AF404B61C1DBB98D409658
                                                                                                                                                                                      Function 00406187 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 551 406187-406193 552 406194-4061c8 GetTickCount GetTempFileNameW 551->552 553 4061d7-4061d9 552->553 554 4061ca-4061cc 552->554 556 4061d1-4061d4 553->556 554->552 555 4061ce 554->555 555->556
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 004061A5
                                                                                                                                                                                      • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,?,0040363E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 004061C0
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CountFileNameTempTick
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                      • API String ID: 1716503409-678247507
                                                                                                                                                                                      • Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                      • Instruction ID: 21b676f9b33da427d45e0b2d6905a63b6509bf3d89a4e990effff8b21c6fdcbe
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C3F09076700214BFEB008F59DD05E9AB7BCEBA1710F11803AEE05EB180E6B0A9648768
                                                                                                                                                                                      Function 00403C25 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 557 403c25-403c34 558 403c40-403c48 557->558 559 403c36-403c39 CloseHandle 557->559 560 403c54-403c60 call 403c82 call 405d74 558->560 561 403c4a-403c4d CloseHandle 558->561 559->558 565 403c65-403c66 560->565 561->560
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C37
                                                                                                                                                                                      • CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C4B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2A
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\nsj906B.tmp\, xrefs: 00403C5B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseHandle
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsj906B.tmp\
                                                                                                                                                                                      • API String ID: 2962429428-2178637407
                                                                                                                                                                                      • Opcode ID: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                      • Instruction ID: ab9e488bef71b432d29da19662b82269d7b8f1628316f3e3d8f7e3aa77a32ace
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3450910aa3eb4a83e9339ad550daa728f038e8843dee50fd20da138f79135bda
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3BE0863244471496E5246F7DAF4D9853B285F413357248726F178F60F0C7389A9B4A9D
                                                                                                                                                                                      Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 649 4015c1-4015d5 call 402da6 call 405fe2 654 401631-401634 649->654 655 4015d7-4015ea call 405f64 649->655 656 401663-4022f6 call 401423 654->656 657 401636-401655 call 401423 call 406668 SetCurrentDirectoryW 654->657 662 401604-401607 call 405c16 655->662 663 4015ec-4015ef 655->663 673 402c2a-402c39 656->673 674 40292e-402935 656->674 657->673 676 40165b-40165e 657->676 672 40160c-40160e 662->672 663->662 666 4015f1-4015f8 call 405c33 663->666 666->662 680 4015fa-4015fd call 405b99 666->680 678 401610-401615 672->678 679 401627-40162f 672->679 674->673 676->673 682 401624 678->682 683 401617-401622 GetFileAttributesW 678->683 679->654 679->655 685 401602 680->685 682->679 683->679 683->682 685->672
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A
                                                                                                                                                                                        • Part of subcall function 00405B99: CreateDirectoryW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405BDC
                                                                                                                                                                                      • SetCurrentDirectoryW.KERNEL32(?,C:\Users\user\PCAppStore,?,00000000,000000F0), ref: 0040164D
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\PCAppStore, xrefs: 00401640
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                      • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                      • API String ID: 1892508949-1816341478
                                                                                                                                                                                      • Opcode ID: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                      • Instruction ID: a0118e7b9b939ef3ea3e51add98df8039a5aa70d3b8e99a19be4f9c31e9f39fe
                                                                                                                                                                                      • Opcode Fuzzy Hash: ff9909915b16c23767ee925164981e8f632181fd0fe0b495a8c7e415af322c96
                                                                                                                                                                                      • Instruction Fuzzy Hash: 04112231508105EBCF30AFA0CD4099E36A0EF15329B28493BF901B22F1DB3E4982DB5E
                                                                                                                                                                                      Function 0040603F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 686 40603f-40605a call 406668 call 405fe2 691 406060-40606d call 4068ef 686->691 692 40605c-40605e 686->692 696 40607d-406081 691->696 697 40606f-406075 691->697 693 4060b8-4060ba 692->693 699 406097-4060a0 lstrlenW 696->699 697->692 698 406077-40607b 697->698 698->692 698->696 700 4060a2-4060b6 call 405f37 GetFileAttributesW 699->700 701 406083-40608a call 40699e 699->701 700->693 706 406091-406092 call 405f83 701->706 707 40608c-40608f 701->707 706->699 707->692 707->706
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00406668: lstrcpynW.KERNEL32(?,?,00000400,004037B0,00429260,NSIS Error), ref: 00406675
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(?,?,00425F50,?,00406056,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00405FF0
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 00405FF5
                                                                                                                                                                                        • Part of subcall function 00405FE2: CharNextW.USER32(00000000), ref: 0040600D
                                                                                                                                                                                      • lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0,00000000), ref: 00406098
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,74DF3420,?,74DF2EE0,00405D94,?,74DF3420,74DF2EE0), ref: 004060A8
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                      • String ID: P_B
                                                                                                                                                                                      • API String ID: 3248276644-906794629
                                                                                                                                                                                      • Opcode ID: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                      • Instruction ID: df110f430b83b9381375b5fd3fa67f6c4419d4890c6468873e0fced3c2676832
                                                                                                                                                                                      • Opcode Fuzzy Hash: 900e3a3aedd828ccf636743a116f58552bc6887dcb5d3e9637a901da882d1290
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0DF07826144A1216E622B23A0C05BAF05098F82354B07063FFC93B22E1DF3C8973C43E
                                                                                                                                                                                      Function 00407194 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                      • Instruction ID: 10cc2cc0f2c892254e5285b7a8bac4c216a70fda8fb68dfa7c3680dd08f727d3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9f3cc98df1e3ecd253cf91825a4064c55af45d063240f038e3dc270cc3f81a7c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 55A15571E04228DBDF28CFA8C8547ADBBB1FF44305F10842AD856BB281D778A986DF45
                                                                                                                                                                                      Function 00407395 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                      • Instruction ID: d49815ad38d406b3cd0a1a90ea7be1526168d9e39684835ffa6a026ef1ef4849
                                                                                                                                                                                      • Opcode Fuzzy Hash: 97748a737734167d5846b9d8dd4738ada3f75d0b833fdafa89234df63502b4a5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 91913270D04228DBEF28CF98C8547ADBBB1FF44305F14816AD856BB281D778A986DF45
                                                                                                                                                                                      Function 004070AB Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                      • Instruction ID: 0a676f48c9952aad729ccf503b6a86ce95496029d8c73069f89f3073be052f6e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 93c083d05bcdf6195ca23c2a54f1652f9efbc2f2339d63ff2f761c89645e7c92
                                                                                                                                                                                      • Instruction Fuzzy Hash: C3813471D08228DFDF24CFA8C8847ADBBB1FB44305F24816AD456BB281D778A986DF05
                                                                                                                                                                                      Function 00406BB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                      • Instruction ID: 41bbaa2e3590000dceee7c9791d291245bc26db239967492cd44d063337b5de0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 42fe04b556333c9da529a864bcd0db0a91825228453d2ef5331aa29539740558
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E814831D08228DBEF28CFA8C8447ADBBB1FF44305F14816AD856B7281D778A986DF45
                                                                                                                                                                                      Function 00406FFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                      • Instruction ID: 4a3513360c1d1cc4287bdabe5afcaa460628bed3c0d7ae87261646ca99be8a9f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ccf24f4e081119859c9f0e48baaaa1d38e3934f3a3b1d8a87677b84cb71901f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D711271D04228DBEF28CF98C9947ADBBF1FB44305F14806AD856B7280D738A986DF05
                                                                                                                                                                                      Function 0040711C Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                      • Instruction ID: aecab3f40db1f9fc07a3dc9ea3777efa7aa3d7dc23f88bc09ddd959c6243594a
                                                                                                                                                                                      • Opcode Fuzzy Hash: c68610f165bc536a6a66ce61bc987e677a2aaa57ebbfa987bd426c3fc0f92c56
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B711571D04228DBEF28CF98C8547ADBBB1FF44305F14806AD856BB281D778A986DF05
                                                                                                                                                                                      Function 00407068 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                      • Instruction ID: 947ff9f4813c08031b822263453b6bbc7859602ae013fffc9a74d3363ad91bbb
                                                                                                                                                                                      • Opcode Fuzzy Hash: b33066b9a67caffcdb2859c2a3d237c195f810e8b6f417b46283b98aba377de3
                                                                                                                                                                                      • Instruction Fuzzy Hash: FE713471E04228DBEF28CF98C8547ADBBB1FF44305F15806AD856BB281C778A986DF45
                                                                                                                                                                                      Function 00403479 Relevance: 4.6, APIs: 3, Instructions: 101COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 0040348D
                                                                                                                                                                                        • Part of subcall function 004035F8: SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 004034C0
                                                                                                                                                                                      • SetFilePointer.KERNEL32(12F86091,00000000,00000000,00414EF0,00004000,?,00000000,004033A3,00000004,00000000,00000000,?,?,0040331D,000000FF,00000000), ref: 004035BB
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FilePointer$CountTick
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1092082344-0
                                                                                                                                                                                      • Opcode ID: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                      • Instruction ID: 4a0f782daef8a724a5dada35133bb9654e3c612a62d69fcdf17392b9264be50a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ac154d52ea9800dffc85ef1316eb03f3be91f57b238af8bcd161a90f23d8065
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3A31AEB2650205EFC7209F29EE848263BADF70475A755023BE900B22F1C7B59D42DB9D
                                                                                                                                                                                      Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402103
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                        • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402114
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 334405425-0
                                                                                                                                                                                      • Opcode ID: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                      • Instruction ID: 1e7e134340f86907485d462c64894228b35b3344cd4f3d252167f9901203d809
                                                                                                                                                                                      • Opcode Fuzzy Hash: 52f8d756bd50154f6a3dea7293860066d65bf9effb7e174b318ab9c425843f66
                                                                                                                                                                                      • Instruction Fuzzy Hash: C521C231904104FADF11AFA5CF48A9D7A70BF48354F60413BF605B91E0DBBD8A929A5D
                                                                                                                                                                                      Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GlobalFree.KERNEL32(03865038), ref: 00401C0B
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401C1D
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Global$AllocFreelstrcatlstrlen
                                                                                                                                                                                      • String ID: get
                                                                                                                                                                                      • API String ID: 3292104215-4248514160
                                                                                                                                                                                      • Opcode ID: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                      • Instruction ID: d74cddccbdd50a14e5bf5e3e63826a63b2a65df0fd836753f00777670cd3b466
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4319b31a17754bffce461f57a5489b402a00cd847fb6eeae40cdae925115eaf0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5321D872904210DBDB20EFA4DEC4E5E73A4AB047157150A3BF542F72D0D6BD9C518BAD
                                                                                                                                                                                      Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
                                                                                                                                                                                      • RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Enum$CloseValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 397863658-0
                                                                                                                                                                                      • Opcode ID: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                      • Instruction ID: fdd171a53236be04b49e80cc8c25aaf428e2db1c32e81cf7e645575326a8d696
                                                                                                                                                                                      • Opcode Fuzzy Hash: a2874957321bf6034ab335a01143add9f6f6121a8284cc98450072ad0413cc1f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 35017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61D0EBB85E45966D
                                                                                                                                                                                      Function 00405D2C Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00406133: GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                        • Part of subcall function 00406133: SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                      • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D47
                                                                                                                                                                                      • DeleteFileW.KERNEL32(?,?,?,00000000,00405F0E), ref: 00405D4F
                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405D67
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1655745494-0
                                                                                                                                                                                      • Opcode ID: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                      • Instruction ID: f7500ddcb6900c42920b0fa7cdf939b3a50fd8fb6693fff67202f671924a8b23
                                                                                                                                                                                      • Opcode Fuzzy Hash: 80ad4dccc83bd5cfbcd7ef077da852fe0cb096cb549a199170c52783d075929e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DE0E531218A9156C3207734AD0CB5B2A98EF86314F09893FF5A2B11E0D77885078AAD
                                                                                                                                                                                      Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\PCAppStore, xrefs: 00402269
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                      • String ID: C:\Users\user\PCAppStore
                                                                                                                                                                                      • API String ID: 542301482-1816341478
                                                                                                                                                                                      • Opcode ID: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                      • Instruction ID: f110e38d5ccd8909b9e85e2ea6b1342c5fae2602ce40754bea02e3b472428d32
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4e8b9e8d9efc1323b126c51a2f9450484e7b2217165b473e9f4f1a567a0bf10e
                                                                                                                                                                                      • Instruction Fuzzy Hash: BC411771A00209EFCF40DFE4C989E9D7BB5BF49304B20456AF505EB2D1DB799981CB94
                                                                                                                                                                                      Function 004064D5 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegOpenKeyExW.KERNEL32(00000000,00000000,00000000,?,?,00422728,?,('B,00406563,('B,00000000,?,?,get,?), ref: 004064F9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Open
                                                                                                                                                                                      • String ID: ('B
                                                                                                                                                                                      • API String ID: 71445658-2332581011
                                                                                                                                                                                      • Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                      • Instruction ID: 5036765eb4ab6e58186d81024f5778724aa2024cd81e2e1d5ca813995cf5404a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
                                                                                                                                                                                      • Instruction Fuzzy Hash: BAD0123210020DBBDF115F90AD01FAB375DAB08310F018426FE06A4092D775D534A728
                                                                                                                                                                                      Function 00403371 Relevance: 3.1, APIs: 2, Instructions: 88COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,0040331D,000000FF,00000000,00000000,?,?), ref: 00403396
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FilePointer
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 973152223-0
                                                                                                                                                                                      • Opcode ID: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                      • Instruction ID: 963a71f16df831595788c30304fa9cedbf2cad19eb63879c1ada4fe15c9ed8fa
                                                                                                                                                                                      • Opcode Fuzzy Hash: b1bf35b654f0c361909532a2badc84153f12731a676864620281ad9f652e4f28
                                                                                                                                                                                      • Instruction Fuzzy Hash: 93319F70200219EFDB129F65ED84E9A3FA8FF00355B10443AF905EA1A1D778CE51DBA9
                                                                                                                                                                                      Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
                                                                                                                                                                                      • RegCloseKey.KERNEL32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj906B.tmp,00000000,00000011,00000002), ref: 004025FD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseQueryValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3356406503-0
                                                                                                                                                                                      • Opcode ID: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                      • Instruction ID: eaee0c709954dca67eb2d1c59e66f6ca2c08a593dad46a4828cc6951ae7b5872
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f519eafec3af35988992028302c1fe2ffbfb85c9afca13b7af9384ace0fec36
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5D
                                                                                                                                                                                      Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                      • SendMessageW.USER32(?,00000402,00000000), ref: 004013F4
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3850602802-0
                                                                                                                                                                                      • Opcode ID: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                      • Instruction ID: af17251ef12b8b272b5eaf8d1bef107274ce64b6e67bb2dd4604cf2723900e86
                                                                                                                                                                                      • Opcode Fuzzy Hash: 09e122a9c5ca6d14e20a0c17f6d9bb0c47d9e5f073d0cae9cf8d248ab6fa9320
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6F012831724220EBEB295B389D05B6A3698E710714F10857FF855F76F1E678CC029B6D
                                                                                                                                                                                      Function 00405C4B Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                      • CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateHandleProcess
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3712363035-0
                                                                                                                                                                                      • Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                      • Instruction ID: 91309136e62a13352d93043ad9bb7922807806bb2ea2f765c8e9c4a894a003d9
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
                                                                                                                                                                                      • Instruction Fuzzy Hash: 59E0B6B4600209BFFB109B64EE09F7B7BADFB04648F414565BD51F2190D778A8158A78
                                                                                                                                                                                      Function 00406A35 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetModuleHandleA.KERNEL32(?,00000020,?,00403750,0000000B), ref: 00406A47
                                                                                                                                                                                      • GetProcAddress.KERNEL32(00000000,?), ref: 00406A62
                                                                                                                                                                                        • Part of subcall function 004069C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004069DC
                                                                                                                                                                                        • Part of subcall function 004069C5: wsprintfW.USER32 ref: 00406A17
                                                                                                                                                                                        • Part of subcall function 004069C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406A2B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2547128583-0
                                                                                                                                                                                      • Opcode ID: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                      • Instruction ID: 0464b4a7853edb7079d0776797c383171681067eb8499b99987f1e8ea9f8efb8
                                                                                                                                                                                      • Opcode Fuzzy Hash: a89557e88259ac32882439a66efe2bded2b7fe37332f597cb2162f61758b0433
                                                                                                                                                                                      • Instruction Fuzzy Hash: E0E086727042106AD210A6745D08D3773E8ABC6711307883EF557F2040D738DC359A79
                                                                                                                                                                                      Function 00403C82 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,74DF3420,00000000,74DF2EE0,00403C59,C:\Users\user\AppData\Local\Temp\,00403B71,?), ref: 00403C9C
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 00403CA3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Free$GlobalLibrary
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1100898210-0
                                                                                                                                                                                      • Opcode ID: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                      • Instruction ID: 1b4b668df254a36c82b8f96f79c5ae0e05fb6c29bd97d86a5de4613e9375b038
                                                                                                                                                                                      • Opcode Fuzzy Hash: e868f33ba05eeb96666b2da3448a48ed76ae7177416a2bb01e196352cb617163
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0AE08C335052205BD6211F55EA0875A7768AF94B26F06006AE980BB26087781C424BC8
                                                                                                                                                                                      Function 00406158 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                      • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$AttributesCreate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 415043291-0
                                                                                                                                                                                      • Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                      • Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
                                                                                                                                                                                      • Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
                                                                                                                                                                                      • Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19
                                                                                                                                                                                      Function 00406133 Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetFileAttributesW.KERNEL32(?,?,00405D38,?,?,00000000,00405F0E,?,?,?,?), ref: 00406138
                                                                                                                                                                                      • SetFileAttributesW.KERNEL32(?,00000000), ref: 0040614C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AttributesFile
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3188754299-0
                                                                                                                                                                                      • Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                      • Instruction ID: 3e6336b5c460747e2e1e0fbe3c4db8defb42c0044e1a92967a1d29a512d2a4bc
                                                                                                                                                                                      • Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
                                                                                                                                                                                      • Instruction Fuzzy Hash: 73D0C972514130ABC2102728AE0889ABB56EB64271B014A35F9A5A62B0CB304C628A98
                                                                                                                                                                                      Function 00405C16 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00000000,00403633,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405C1C
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00405C2A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1375471231-0
                                                                                                                                                                                      • Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                      • Instruction ID: 66e62c5d6c7775ff4cea72667941029308d228c48495a605f612c1d2d9e1fc74
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
                                                                                                                                                                                      • Instruction Fuzzy Hash: FBC04C31218605AEE7605B219F0CB177A94DB50741F114839E186F40A0DA788455D92D
                                                                                                                                                                                      Function 00406503 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 0040652C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Create
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2289755597-0
                                                                                                                                                                                      • Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                      • Instruction ID: 390987c888b9fe28ccc3a202ccefe0e129b8fdbaba7b34d45eb5723cdb444700
                                                                                                                                                                                      • Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: C1E0ECB2010109BEEF099F90EC0ADBB372DEB04704F41492EF907E4091E6B5AE70AA34
                                                                                                                                                                                      Function 0040620A Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • WriteFile.KERNEL32(?,00000000,00000000,00000000,00000000,00412A94,0040CEF0,00403579,0040CEF0,00412A94,00414EF0,00004000,?,00000000,004033A3,00000004), ref: 0040621E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                                      • Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                      • Instruction ID: 398385dbb58ca0a44fa402a726e0ab0b2131cea3ae709c8a1b666252059dd88a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
                                                                                                                                                                                      • Instruction Fuzzy Hash: F6E08632141129EBCF10AE548C00EEB375CFB01350F014476F955E3040D330E93087A5
                                                                                                                                                                                      Function 004061DB Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,004035F5,?,?,004034F9,00414EF0,00004000,?,00000000,004033A3), ref: 004061EF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileRead
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2738559852-0
                                                                                                                                                                                      • Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                      • Instruction ID: 689b8facb1381159ac92aeccc4703b7db47ce2620db9a14c340ec3ef8a35c8b1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C1E0863250021AABDF10AE518C04AEB375CEB01360F014477F922E2150D230E82187E8
                                                                                                                                                                                      Function 004035F8 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetFilePointer.KERNEL32(00000000,00000000,00000000,004032F6,?), ref: 00403606
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FilePointer
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 973152223-0
                                                                                                                                                                                      • Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                      • Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
                                                                                                                                                                                      • Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D
                                                                                                                                                                                      Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                        • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                        • Part of subcall function 00405C4B: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,00000000,00000000), ref: 00405C74
                                                                                                                                                                                        • Part of subcall function 00405C4B: CloseHandle.KERNEL32(?), ref: 00405C81
                                                                                                                                                                                      • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB
                                                                                                                                                                                        • Part of subcall function 00406AE0: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406AF1
                                                                                                                                                                                        • Part of subcall function 00406AE0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406B13
                                                                                                                                                                                        • Part of subcall function 004065AF: wsprintfW.USER32 ref: 004065BC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2972824698-0
                                                                                                                                                                                      • Opcode ID: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                      • Instruction ID: 7fe263eab699b123ac8c37dffe14ee58438593542e676086741668bd6549bbba
                                                                                                                                                                                      • Opcode Fuzzy Hash: 39558c5643c496eaffaca9d6483fe6d6b72d5b00fb47a50e88cd8089dc569f6d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3DF09072905112EBDF21BBA59AC4DAE76A4DF01318B25453BE102B21E0D77C4E528A6E

                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                      Function 00405809 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000403), ref: 00405867
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EE), ref: 00405876
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 004058B3
                                                                                                                                                                                      • GetSystemMetrics.USER32(00000002), ref: 004058BA
                                                                                                                                                                                      • SendMessageW.USER32(?,00001061,00000000,?), ref: 004058DB
                                                                                                                                                                                      • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004058EC
                                                                                                                                                                                      • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004058FF
                                                                                                                                                                                      • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040590D
                                                                                                                                                                                      • SendMessageW.USER32(?,00001024,00000000,?), ref: 00405920
                                                                                                                                                                                      • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405942
                                                                                                                                                                                      • ShowWindow.USER32(?,00000008), ref: 00405956
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EC), ref: 00405977
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405987
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004059A0
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004059AC
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003F8), ref: 00405885
                                                                                                                                                                                        • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003EC), ref: 004059C9
                                                                                                                                                                                      • CreateThread.KERNEL32(00000000,00000000,Function_0000579D,00000000), ref: 004059D7
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000), ref: 004059DE
                                                                                                                                                                                      • ShowWindow.USER32(00000000), ref: 00405A02
                                                                                                                                                                                      • ShowWindow.USER32(?,00000008), ref: 00405A07
                                                                                                                                                                                      • ShowWindow.USER32(00000008), ref: 00405A51
                                                                                                                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405A85
                                                                                                                                                                                      • CreatePopupMenu.USER32 ref: 00405A96
                                                                                                                                                                                      • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405AAA
                                                                                                                                                                                      • GetWindowRect.USER32(?,?), ref: 00405ACA
                                                                                                                                                                                      • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405AE3
                                                                                                                                                                                      • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B1B
                                                                                                                                                                                      • OpenClipboard.USER32(00000000), ref: 00405B2B
                                                                                                                                                                                      • EmptyClipboard.USER32 ref: 00405B31
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405B3D
                                                                                                                                                                                      • GlobalLock.KERNEL32(00000000), ref: 00405B47
                                                                                                                                                                                      • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405B5B
                                                                                                                                                                                      • GlobalUnlock.KERNEL32(00000000), ref: 00405B7B
                                                                                                                                                                                      • SetClipboardData.USER32(0000000D,00000000), ref: 00405B86
                                                                                                                                                                                      • CloseClipboard.USER32 ref: 00405B8C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                      • String ID: H7B${
                                                                                                                                                                                      • API String ID: 590372296-2256286769
                                                                                                                                                                                      • Opcode ID: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                      • Instruction ID: d0bbb34d81c2c7a38b5cdb5171fa906e4f4201ee6cbe22cb0b3272b57562556b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0185fb71cb0ebac8bb253ddb79263eb6e3c4c27c477fa06c1930d1494c9be16a
                                                                                                                                                                                      • Instruction Fuzzy Hash: D8B137B0900608FFDF119FA0DD89AAE7B79FB08354F00417AFA45A61A0CB755E52DF68
                                                                                                                                                                                      Function 00405031 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003F9), ref: 00405049
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000408), ref: 00405054
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,?), ref: 0040509E
                                                                                                                                                                                      • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 004050B5
                                                                                                                                                                                      • SetWindowLongW.USER32(?,000000FC,0040563E), ref: 004050CE
                                                                                                                                                                                      • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004050E2
                                                                                                                                                                                      • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004050F4
                                                                                                                                                                                      • SendMessageW.USER32(?,00001109,00000002), ref: 0040510A
                                                                                                                                                                                      • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405116
                                                                                                                                                                                      • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405128
                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 0040512B
                                                                                                                                                                                      • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405156
                                                                                                                                                                                      • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405162
                                                                                                                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 004051FD
                                                                                                                                                                                      • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040522D
                                                                                                                                                                                        • Part of subcall function 004045F9: SendMessageW.USER32(00000028,?,00000001,00404424), ref: 00404607
                                                                                                                                                                                      • SendMessageW.USER32(?,00001132,00000000,?), ref: 00405241
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 0040526F
                                                                                                                                                                                      • SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040527D
                                                                                                                                                                                      • ShowWindow.USER32(?,00000005), ref: 0040528D
                                                                                                                                                                                      • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405388
                                                                                                                                                                                      • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004053ED
                                                                                                                                                                                      • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405402
                                                                                                                                                                                      • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405426
                                                                                                                                                                                      • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405446
                                                                                                                                                                                      • ImageList_Destroy.COMCTL32(?), ref: 0040545B
                                                                                                                                                                                      • GlobalFree.KERNEL32(?), ref: 0040546B
                                                                                                                                                                                      • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004054E4
                                                                                                                                                                                      • SendMessageW.USER32(?,00001102,?,?), ref: 0040558D
                                                                                                                                                                                      • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040559C
                                                                                                                                                                                      • InvalidateRect.USER32(?,00000000,00000001), ref: 004055C7
                                                                                                                                                                                      • ShowWindow.USER32(?,00000000), ref: 00405615
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003FE), ref: 00405620
                                                                                                                                                                                      • ShowWindow.USER32(00000000), ref: 00405627
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                      • String ID: $M$N
                                                                                                                                                                                      • API String ID: 2564846305-813528018
                                                                                                                                                                                      • Opcode ID: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                      • Instruction ID: a1eb65f7683e17450fca8d4cb4c1055b074660be5b1b810df034ff690b7f681c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 950969970af6d10ef62121ad67a768569704eb6391eae900e1ce4f9d1827afee
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A025CB0900609EFDF20DF65CD45AAE7BB5FB44315F10817AEA10BA2E1D7798A52CF18
                                                                                                                                                                                      Function 004040C5 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404101
                                                                                                                                                                                      • ShowWindow.USER32(?), ref: 00404121
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000F0), ref: 00404133
                                                                                                                                                                                      • ShowWindow.USER32(?,00000004), ref: 0040414C
                                                                                                                                                                                      • DestroyWindow.USER32 ref: 00404160
                                                                                                                                                                                      • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404179
                                                                                                                                                                                      • GetDlgItem.USER32(?,?), ref: 00404198
                                                                                                                                                                                      • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004041AC
                                                                                                                                                                                      • IsWindowEnabled.USER32(00000000), ref: 004041B3
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000001), ref: 0040425E
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000002), ref: 00404268
                                                                                                                                                                                      • SetClassLongW.USER32(?,000000F2,?), ref: 00404282
                                                                                                                                                                                      • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004042D3
                                                                                                                                                                                      • GetDlgItem.USER32(?,00000003), ref: 00404379
                                                                                                                                                                                      • ShowWindow.USER32(00000000,?), ref: 0040439A
                                                                                                                                                                                      • EnableWindow.USER32(?,?), ref: 004043AC
                                                                                                                                                                                      • EnableWindow.USER32(?,?), ref: 004043C7
                                                                                                                                                                                      • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004043DD
                                                                                                                                                                                      • EnableMenuItem.USER32(00000000), ref: 004043E4
                                                                                                                                                                                      • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004043FC
                                                                                                                                                                                      • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040440F
                                                                                                                                                                                      • lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404439
                                                                                                                                                                                      • SetWindowTextW.USER32(?,00423748), ref: 0040444D
                                                                                                                                                                                      • ShowWindow.USER32(?,0000000A), ref: 00404581
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
                                                                                                                                                                                      • String ID: H7B
                                                                                                                                                                                      • API String ID: 1860320154-2300413410
                                                                                                                                                                                      • Opcode ID: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                      • Instruction ID: 1d4a55fced449df2e2a9dfc159c1061f424388fbea236c5341ec002980a30b6c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f4dad2f818047668635e16f952da299a81014d83ff1599baf972819d0fbfd0c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C0C1C2B1600604FBDB216F61EE85E2A3B78EB85745F40097EF781B51F0CB3958529B2E
                                                                                                                                                                                      Function 00404783 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404821
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003E8), ref: 00404835
                                                                                                                                                                                      • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404852
                                                                                                                                                                                      • GetSysColor.USER32(?), ref: 00404863
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404871
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040487F
                                                                                                                                                                                      • lstrlenW.KERNEL32(?), ref: 00404884
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404891
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004048A6
                                                                                                                                                                                      • GetDlgItem.USER32(?,0000040A), ref: 004048FF
                                                                                                                                                                                      • SendMessageW.USER32(00000000), ref: 00404906
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003E8), ref: 00404931
                                                                                                                                                                                      • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404974
                                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F02), ref: 00404982
                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 00404985
                                                                                                                                                                                      • LoadCursorW.USER32(00000000,00007F00), ref: 0040499E
                                                                                                                                                                                      • SetCursor.USER32(00000000), ref: 004049A1
                                                                                                                                                                                      • SendMessageW.USER32(00000111,00000001,00000000), ref: 004049D0
                                                                                                                                                                                      • SendMessageW.USER32(00000010,00000000,00000000), ref: 004049E2
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                      • String ID: N$get
                                                                                                                                                                                      • API String ID: 3103080414-214687294
                                                                                                                                                                                      • Opcode ID: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                      • Instruction ID: 690b4d321b533a2a97605fa3f7bb2423a24794fe1ec6c961d913f822d5f12d1b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7b7ce6e7f04c0852b245e81234b58653da2c4cab9b10fb98097c13f3cf17b06e
                                                                                                                                                                                      • Instruction Fuzzy Hash: AB6181F1900209FFDB109F61CD85A6A7B69FB84304F00813AF705B62E0C7799951DFA9
                                                                                                                                                                                      Function 00404AB5 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 275stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,000003FB), ref: 00404B04
                                                                                                                                                                                      • SetWindowTextW.USER32(00000000,?), ref: 00404B2E
                                                                                                                                                                                      • SHBrowseForFolderW.SHELL32(?), ref: 00404BDF
                                                                                                                                                                                      • CoTaskMemFree.OLE32(00000000), ref: 00404BEA
                                                                                                                                                                                      • lstrcmpiW.KERNEL32(get,00423748,00000000,?,?), ref: 00404C1C
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,get), ref: 00404C28
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404C3A
                                                                                                                                                                                        • Part of subcall function 00405CAC: GetDlgItemTextW.USER32(?,?,00000400,00404C71), ref: 00405CBF
                                                                                                                                                                                        • Part of subcall function 004068EF: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                        • Part of subcall function 004068EF: CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                        • Part of subcall function 004068EF: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                        • Part of subcall function 004068EF: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                      • GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404CFD
                                                                                                                                                                                      • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404D18
                                                                                                                                                                                        • Part of subcall function 00404E71: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                        • Part of subcall function 00404E71: wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                        • Part of subcall function 00404E71: SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                      • String ID: 5445468$A$C:\Users\user\PCAppStore$H7B$get
                                                                                                                                                                                      • API String ID: 2624150263-500363812
                                                                                                                                                                                      • Opcode ID: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                      • Instruction ID: 9155a42c54a3203d4d9709c494e168d8d926bd307d67cbb08bf4d9f42020e7e3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 667bbe0a30595837a03e9c6ce466c2f6c83f7bc5ead90454ae6c6de6e9a81711
                                                                                                                                                                                      • Instruction Fuzzy Hash: 94A171F1900219ABDB11EFA5CD41AAFB7B8EF84315F11843BF601B62D1D77C8A418B69
                                                                                                                                                                                      Function 004062AE Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406449,?,?), ref: 004062E9
                                                                                                                                                                                      • GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004062F2
                                                                                                                                                                                        • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                        • Part of subcall function 004060BD: lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                      • GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 0040630F
                                                                                                                                                                                      • wsprintfA.USER32 ref: 0040632D
                                                                                                                                                                                      • GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406368
                                                                                                                                                                                      • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406377
                                                                                                                                                                                      • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004063AF
                                                                                                                                                                                      • SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 00406405
                                                                                                                                                                                      • GlobalFree.KERNEL32(00000000), ref: 00406416
                                                                                                                                                                                      • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040641D
                                                                                                                                                                                        • Part of subcall function 00406158: GetFileAttributesW.KERNEL32(00000003,00403113,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 0040615C
                                                                                                                                                                                        • Part of subcall function 00406158: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040617E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                      • String ID: %ls=%ls$[Rename]$mB$uB$uB
                                                                                                                                                                                      • API String ID: 2171350718-2295842750
                                                                                                                                                                                      • Opcode ID: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                      • Instruction ID: df9b4e9fb9d32bd4c250032a1d399944af7a2e4c2f0bdec2b7d3959d12e60cc8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 07ea5d3dd502240bf86d0c298f94c43ad2335bec49c481c59c36197298e6ebad
                                                                                                                                                                                      • Instruction Fuzzy Hash: B8314331200315BBD2206B619D49F5B3AACEF85704F16003BFD02FA2C2EA7DD82186BD
                                                                                                                                                                                      Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                      • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                      • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                      • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                      • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                      • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                      • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                      • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                      • DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                      • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                      • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                      • String ID: F
                                                                                                                                                                                      • API String ID: 941294808-1304234792
                                                                                                                                                                                      • Opcode ID: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                      • Instruction ID: e2f9fea5dfd6f059ba8eeb08e8d10ac227d01a2162b8a260283931f50cd0bfbf
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8da9fae8b34351ceae2931000ebd9f39a308799c7d87b7a6dbcfe72b45b7384c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 33418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7349A55DFA4
                                                                                                                                                                                      Function 004056CA Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                      • lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                      • lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                      • SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                      • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                      • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                      • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSendlstrlen$lstrcat$TextWindow
                                                                                                                                                                                      • String ID: ('B
                                                                                                                                                                                      • API String ID: 1495540970-2332581011
                                                                                                                                                                                      • Opcode ID: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                      • Instruction ID: 7f52a71d89202be05388d2ae90ba5930d13dcc1e6093ad3ff4eaa481a322a782
                                                                                                                                                                                      • Opcode Fuzzy Hash: da0887550f177a20a5adca650a80eb3065253b4758cf57a6ba66e38fd01475e6
                                                                                                                                                                                      • Instruction Fuzzy Hash: C6217A71900518FACB119FA5DD84A8EBFB8EB45360F10857AF904B62A0D67A4A509F68
                                                                                                                                                                                      Function 0040462B Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetWindowLongW.USER32(?,000000EB), ref: 00404648
                                                                                                                                                                                      • GetSysColor.USER32(00000000), ref: 00404686
                                                                                                                                                                                      • SetTextColor.GDI32(?,00000000), ref: 00404692
                                                                                                                                                                                      • SetBkMode.GDI32(?,?), ref: 0040469E
                                                                                                                                                                                      • GetSysColor.USER32(?), ref: 004046B1
                                                                                                                                                                                      • SetBkColor.GDI32(?,?), ref: 004046C1
                                                                                                                                                                                      • DeleteObject.GDI32(?), ref: 004046DB
                                                                                                                                                                                      • CreateBrushIndirect.GDI32(?), ref: 004046E5
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2320649405-0
                                                                                                                                                                                      • Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                      • Instruction ID: e78b8cc9c8042372c9a7340b9b8aa9b23ded286a9f8ddc7240a2e2d8bd1f46c0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
                                                                                                                                                                                      • Instruction Fuzzy Hash: DE2197715007049FC7309F28D908B5BBBF8AF42714F008D2EE992A22E1D739D944DB58
                                                                                                                                                                                      Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • ReadFile.KERNEL32(?,?,?,?), ref: 00402758
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC
                                                                                                                                                                                        • Part of subcall function 00406239: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040624F
                                                                                                                                                                                      • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                      • String ID: 9
                                                                                                                                                                                      • API String ID: 163830602-2366072709
                                                                                                                                                                                      • Opcode ID: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                      • Instruction ID: 581cf2785626502de532f206a1de9da9d9b8d20bcd24121b7f7bd1133decb9a2
                                                                                                                                                                                      • Opcode Fuzzy Hash: c494a9c5f1831dca55446a6dfc25bb45b63b896379fbbdb0ec38153142a3ac1c
                                                                                                                                                                                      • Instruction Fuzzy Hash: CE51FB75D00219AADF20EF95CA88AAEBB75FF04304F50417BE541B62D4D7B49D82CB58
                                                                                                                                                                                      Function 004068EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406952
                                                                                                                                                                                      • CharNextW.USER32(?,?,?,00000000,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406961
                                                                                                                                                                                      • CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406966
                                                                                                                                                                                      • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,?,0040361B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00406979
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Char$Next$Prev
                                                                                                                                                                                      • String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 589700163-4010320282
                                                                                                                                                                                      • Opcode ID: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                      • Instruction ID: d28fb8c2eefe6f61a155ceb01790bbf8b21f4710aa7989e54d8eeb8481a577c9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4a25a2118415850d7bb15acf585ec7f7b5de772317bec8c7d00468289de3f440
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2611089580061295DB303B18CC40BB762F8AF99B50F12403FE98A776C1E77C4C9286BD
                                                                                                                                                                                      Function 0040302E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • DestroyWindow.USER32(00000000,00000000), ref: 00403049
                                                                                                                                                                                      • GetTickCount.KERNEL32 ref: 00403067
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00403095
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000,?), ref: 00405702
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrlenW.KERNEL32(004030A8,00422728,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030A8,00000000), ref: 00405712
                                                                                                                                                                                        • Part of subcall function 004056CA: lstrcatW.KERNEL32(00422728,004030A8,004030A8,00422728,00000000,00000000,00000000), ref: 00405725
                                                                                                                                                                                        • Part of subcall function 004056CA: SetWindowTextW.USER32(00422728,00422728), ref: 00405737
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040575D
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405777
                                                                                                                                                                                        • Part of subcall function 004056CA: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405785
                                                                                                                                                                                      • CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 004030B9
                                                                                                                                                                                      • ShowWindow.USER32(00000000,00000005), ref: 004030C7
                                                                                                                                                                                        • Part of subcall function 00403012: MulDiv.KERNEL32(00000000,00000064,00015C8B), ref: 00403027
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
                                                                                                                                                                                      • String ID: ... %d%%
                                                                                                                                                                                      • API String ID: 722711167-2449383134
                                                                                                                                                                                      • Opcode ID: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                      • Instruction ID: 5af6bf9b0b70cf9307c1258d0e5a667b07be53d22b58a3258066d7aee54b172b
                                                                                                                                                                                      • Opcode Fuzzy Hash: a65563718f57099a27635650194dd277da09fbe66beefc8d93bb4be83c5e7891
                                                                                                                                                                                      • Instruction Fuzzy Hash: E8018E70553614DBC7317F60AE08A5A3EACAB00F06F54457AF841B21E9DAB84645CBAE
                                                                                                                                                                                      Function 00404F7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404F9A
                                                                                                                                                                                      • GetMessagePos.USER32 ref: 00404FA2
                                                                                                                                                                                      • ScreenToClient.USER32(?,?), ref: 00404FBC
                                                                                                                                                                                      • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404FCE
                                                                                                                                                                                      • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404FF4
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$Send$ClientScreen
                                                                                                                                                                                      • String ID: f
                                                                                                                                                                                      • API String ID: 41195575-1993550816
                                                                                                                                                                                      • Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                      • Instruction ID: ce4c7d6d39dceca23aa6ebdb29af7737867007859e7bede0b388bd4d525dd41f
                                                                                                                                                                                      • Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C014C71940219BADB00DBA4DD85BFEBBB8AF54711F10012BBB50B61C0D6B49A058BA5
                                                                                                                                                                                      Function 00402F93 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00402FE5
                                                                                                                                                                                      • SetWindowTextW.USER32(?,?), ref: 00402FF5
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403007
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                      • String ID: unpacking data: %d%%$verifying installer: %d%%
                                                                                                                                                                                      • API String ID: 1451636040-1158693248
                                                                                                                                                                                      • Opcode ID: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                      • Instruction ID: 34ad84b97f90b05cf42cbebec4ee1aaae98efe268bf46a139428006d78f28757
                                                                                                                                                                                      • Opcode Fuzzy Hash: b65fa6b26e28fa793ab4966251e07a6fe500b79f9b1e2f9c66e5bc42e84335f7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 25F0497050020DABEF246F60DD49BEA3B69FB00309F00803AFA05B51D0DFBD9A559F59
                                                                                                                                                                                      Function 00404E71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404F12
                                                                                                                                                                                      • wsprintfW.USER32 ref: 00404F1B
                                                                                                                                                                                      • SetDlgItemTextW.USER32(?,00423748), ref: 00404F2E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                      • String ID: %u.%u%s%s$H7B
                                                                                                                                                                                      • API String ID: 3540041739-107966168
                                                                                                                                                                                      • Opcode ID: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                      • Instruction ID: 20619224473e8c08b4fba53027c62ddcf1c3fef784a2ba69f514aa474de30786
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2edccdcb36c72f9bdce7a586f7ca7ee262dfb9f9a49697097ea36a1117f17e36
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1A11D8736041283BDB00A5ADDC45E9F3298AB81338F150637FA26F61D1EA79882182E8
                                                                                                                                                                                      Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
                                                                                                                                                                                      • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
                                                                                                                                                                                      • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1354259210-0
                                                                                                                                                                                      • Opcode ID: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                      • Instruction ID: 37c7ba0f9c491dd7f389852fcb35a119484072d927876f68e32cbd91f0a54eef
                                                                                                                                                                                      • Opcode Fuzzy Hash: 953796069c20d6fa7490a0bfa1861ca0c616837e62ffc418281f2642f3cef6d6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D216B7150010ABBDF11AF94CE89EEF7B7DEB50384F110076F909B21E0D7B49E54AA68
                                                                                                                                                                                      Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDlgItem.USER32(?,?), ref: 00401D9A
                                                                                                                                                                                      • GetClientRect.USER32(?,?), ref: 00401DE5
                                                                                                                                                                                      • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
                                                                                                                                                                                      • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
                                                                                                                                                                                      • DeleteObject.GDI32(00000000), ref: 00401E39
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1849352358-0
                                                                                                                                                                                      • Opcode ID: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                      • Instruction ID: 4d725fdcf847a80329c23b38d7164c003567f542edd6fcacfb34c9ebeef40da9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 100b3177012869429c2005611ce111630833f28d1ab152a2d5a2575cfc39775b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 67212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389951DB98
                                                                                                                                                                                      Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetDC.USER32(?), ref: 00401E51
                                                                                                                                                                                      • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
                                                                                                                                                                                      • MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
                                                                                                                                                                                      • ReleaseDC.USER32(?,00000000), ref: 00401E84
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrcatW.KERNEL32(get,\Microsoft\Internet Explorer\Quick Launch), ref: 0040684A
                                                                                                                                                                                        • Part of subcall function 004066A5: lstrlenW.KERNEL32(get,00000000,00422728,?,00405701,00422728,00000000), ref: 004068A4
                                                                                                                                                                                      • CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2584051700-0
                                                                                                                                                                                      • Opcode ID: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                      • Instruction ID: b9cc094806d22c325402cb6ccb5f5134c2025175c414775df3ff87de861ccae2
                                                                                                                                                                                      • Opcode Fuzzy Hash: e128970cf71a0b284ce18b21917758e509e5717976d06807f88455f58f814df6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8401B571900241EFEB005BB4EE89A9A3FB0AB15301F208939F541B71D2C6B904459BED
                                                                                                                                                                                      Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
                                                                                                                                                                                      • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessageSend$Timeout
                                                                                                                                                                                      • String ID: !
                                                                                                                                                                                      • API String ID: 1777923405-2657877971
                                                                                                                                                                                      • Opcode ID: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                      • Instruction ID: e1c20d37316975b9b94706f7b3abd8da4b7b3b5136eece5bd2aa3cbae88a6c19
                                                                                                                                                                                      • Opcode Fuzzy Hash: b183ccb6ab3284ced798d12f720e161a9248df31e23c89b80f307d5b894ef539
                                                                                                                                                                                      • Instruction Fuzzy Hash: 28219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98
                                                                                                                                                                                      Function 00406536 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,0040A230,00000000,('B,00000000,?,?,get,?,?,0040679D,80000002), ref: 0040657C
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,0040679D,80000002,Software\Microsoft\Windows\CurrentVersion,get,get,get,00000000,00422728), ref: 00406587
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseQueryValue
                                                                                                                                                                                      • String ID: ('B$get
                                                                                                                                                                                      • API String ID: 3356406503-1955485993
                                                                                                                                                                                      • Opcode ID: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                      • Instruction ID: 52dd0fe420a7c1e2827d1a164217834099ee72e945ce70567094b216899e5676
                                                                                                                                                                                      • Opcode Fuzzy Hash: abb8e2472c70d4d58aecb7d0dfcf889930bd109b5a1b9baac0574de2233c5019
                                                                                                                                                                                      • Instruction Fuzzy Hash: C4017C72500209FADF21CF51DD09EDB3BA8EF54364F01803AFD1AA2190D738D964DBA4
                                                                                                                                                                                      Function 00405F37 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F3D
                                                                                                                                                                                      • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040362D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403923), ref: 00405F47
                                                                                                                                                                                      • lstrcatW.KERNEL32(?,0040A014), ref: 00405F59
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp\, xrefs: 00405F37
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                      • API String ID: 2659869361-3081826266
                                                                                                                                                                                      • Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                      • Instruction ID: 9007417a49851ea4d61da9c71e51c63d156abd36d345156a737e00ee84923012
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
                                                                                                                                                                                      • Instruction Fuzzy Hash: 59D05E611019246AC111AB548D04DDB63ACAE85304742046AF601B60A0CB7E196287ED
                                                                                                                                                                                      Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dll), ref: 00402695
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: lstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp\nsj906B.tmp$C:\Users\user\AppData\Local\Temp\nsj906B.tmp\inetc.dll
                                                                                                                                                                                      • API String ID: 1659193697-3515408802
                                                                                                                                                                                      • Opcode ID: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                      • Instruction ID: f1e3379d491753f9d96dc3c217618d2e64da59e9cc8309568291ba5d2d488428
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a86cc41fb3ba1d07c106fca7ec167276fc7dee72b5d11bed2732143b2a4cd05
                                                                                                                                                                                      • Instruction Fuzzy Hash: D511C472A00205EBCB10BBB18E4AA9E76619F44758F21483FE402B61C1DAFD8891965F
                                                                                                                                                                                      Function 0040563E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • IsWindowVisible.USER32(?), ref: 0040566D
                                                                                                                                                                                      • CallWindowProcW.USER32(?,?,?,?), ref: 004056BE
                                                                                                                                                                                        • Part of subcall function 00404610: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404622
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3748168415-3916222277
                                                                                                                                                                                      • Opcode ID: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                      • Instruction ID: 537e1cae7e4c88fb21f4f8cfd237bdd46b0b38e99f2a5e053ca6ba0093d9a5c8
                                                                                                                                                                                      • Opcode Fuzzy Hash: a73dc4e993bde12ea44745026bd4b5676165c6f206d332bc9731ab0fc1b08652
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4401B171200608AFEF205F11DD84A6B3A35EB84361F904837FA08752E0D77F8D929E6D
                                                                                                                                                                                      Function 00405F83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 00405F89
                                                                                                                                                                                      • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,0040313C,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,C:\Users\user\AppData\Local\Temp\nsq4808.tmp,80000000,00000003), ref: 00405F99
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • C:\Users\user\AppData\Local\Temp, xrefs: 00405F83
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CharPrevlstrlen
                                                                                                                                                                                      • String ID: C:\Users\user\AppData\Local\Temp
                                                                                                                                                                                      • API String ID: 2709904686-47812868
                                                                                                                                                                                      • Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                      • Instruction ID: bd974b3f77e4b05eb9372a1ad14375fba7b947cfa10dd8d614d5bb7090e452f7
                                                                                                                                                                                      • Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6CD05EB2401D219EC3126B04DC00D9F63ACEF51301B4A4866E441AB1A0DB7C5D9186A9
                                                                                                                                                                                      Function 004060BD Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060CD
                                                                                                                                                                                      • lstrcmpiA.KERNEL32(00000000,00000000), ref: 004060E5
                                                                                                                                                                                      • CharNextA.USER32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060F6
                                                                                                                                                                                      • lstrlenA.KERNEL32(00000000,?,00000000,004063A2,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FF
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 00000009.00000002.2493857905.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                      • Associated: 00000009.00000002.2493812425.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493939022.0000000000408000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000040A000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000425000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000427000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042B000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.000000000042F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000433000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000435000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000454000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2493986952.0000000000457000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045D000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      • Associated: 00000009.00000002.2494450716.000000000045F000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_9_2_400000_nsq4808.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 190613189-0
                                                                                                                                                                                      • Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                      • Instruction ID: 2f06b96f93541eceebcae48a9adfe7aedd37cb678349478f8cad11de2473fd3e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0BF0F631104054FFDB12DFA4CD00D9EBBA8EF06350B2640BAE841FB321D674DE11A798

                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                      Execution Coverage:15.2%
                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                      Signature Coverage:0.4%
                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                      Total number of Limit Nodes:54
                                                                                                                                                                                      execution_graph 68941 7ff71abe1080 68946 7ff71adc5a90 68941->68946 69090 7ff71abf11a0 68946->69090 68951 7ff71abf11a0 _Mpunct 51 API calls 68952 7ff71adc5b0c 68951->68952 68953 7ff71ac398a0 71 API calls 68952->68953 68954 7ff71adc5b29 68953->68954 68955 7ff71abf11a0 _Mpunct 51 API calls 68954->68955 68956 7ff71adc5b4e 68955->68956 68957 7ff71ac398a0 71 API calls 68956->68957 68958 7ff71adc5b6b 68957->68958 68959 7ff71abf11a0 _Mpunct 51 API calls 68958->68959 68960 7ff71adc5b90 68959->68960 68961 7ff71ac398a0 71 API calls 68960->68961 68962 7ff71adc5bad 68961->68962 68963 7ff71abf11a0 _Mpunct 51 API calls 68962->68963 68964 7ff71adc5bd2 68963->68964 68965 7ff71ac398a0 71 API calls 68964->68965 68966 7ff71adc5bef 68965->68966 68967 7ff71abf11a0 _Mpunct 51 API calls 68966->68967 68968 7ff71adc5c14 68967->68968 68969 7ff71ac398a0 71 API calls 68968->68969 68970 7ff71adc5c31 68969->68970 68971 7ff71abf11a0 _Mpunct 51 API calls 68970->68971 68972 7ff71adc5c56 68971->68972 68973 7ff71ac398a0 71 API calls 68972->68973 68974 7ff71adc5c73 68973->68974 68975 7ff71abf11a0 _Mpunct 51 API calls 68974->68975 68976 7ff71adc5c98 68975->68976 68977 7ff71ac398a0 71 API calls 68976->68977 68978 7ff71adc5cb5 68977->68978 68979 7ff71abf11a0 _Mpunct 51 API calls 68978->68979 68980 7ff71adc5cda 68979->68980 68981 7ff71ac398a0 71 API calls 68980->68981 68982 7ff71adc5cf7 68981->68982 68983 7ff71abf11a0 _Mpunct 51 API calls 68982->68983 68984 7ff71adc5d1c 68983->68984 68985 7ff71ac398a0 71 API calls 68984->68985 68986 7ff71adc5d39 68985->68986 68987 7ff71abf11a0 _Mpunct 51 API calls 68986->68987 68988 7ff71adc5d5e 68987->68988 68989 7ff71ac398a0 71 API calls 68988->68989 68990 7ff71adc5d7b 68989->68990 68991 7ff71abf11a0 _Mpunct 51 API calls 68990->68991 68992 7ff71adc5da0 68991->68992 68993 7ff71ac398a0 71 API calls 68992->68993 68994 7ff71adc5dbd 68993->68994 68995 7ff71abf11a0 _Mpunct 51 API calls 68994->68995 68996 7ff71adc5de2 68995->68996 68997 7ff71ac398a0 71 API calls 68996->68997 68998 7ff71adc5dfc 68997->68998 68999 7ff71abf11a0 _Mpunct 51 API calls 68998->68999 69000 7ff71adc5e21 68999->69000 69001 7ff71ac398a0 71 API calls 69000->69001 69002 7ff71adc5e3b 69001->69002 69003 7ff71abf11a0 _Mpunct 51 API calls 69002->69003 69004 7ff71adc5e60 69003->69004 69005 7ff71ac398a0 71 API calls 69004->69005 69006 7ff71adc5e7a 69005->69006 69007 7ff71abf11a0 _Mpunct 51 API calls 69006->69007 69008 7ff71adc5e9f 69007->69008 69009 7ff71ac398a0 71 API calls 69008->69009 69010 7ff71adc5eb9 69009->69010 69011 7ff71abf11a0 _Mpunct 51 API calls 69010->69011 69012 7ff71adc5ede 69011->69012 69013 7ff71ac398a0 71 API calls 69012->69013 69014 7ff71adc5ef8 69013->69014 69015 7ff71abf11a0 _Mpunct 51 API calls 69014->69015 69016 7ff71adc5f1d 69015->69016 69017 7ff71ac398a0 71 API calls 69016->69017 69091 7ff71abf11c7 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock _Mpunct _WChar_traits 69090->69091 69127 7ff71abeb440 69091->69127 69093 7ff71abf11ec 69094 7ff71ac398a0 69093->69094 69095 7ff71abf11a0 _Mpunct 51 API calls 69094->69095 69096 7ff71ac398cd 69095->69096 69187 7ff71ac38170 69096->69187 69106 7ff71ac39943 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 69209 7ff71ac389d0 69106->69209 69108 7ff71ac39a29 Concurrency::details::WorkQueue::IsStructuredEmpty 69222 7ff71abf04b0 69108->69222 69111 7ff71ac3997b shared_ptr 69111->69108 69234 7ff71ac38200 47 API calls 69111->69234 69235 7ff71ac39cd0 51 API calls 2 library calls 69111->69235 69115 7ff71ac39a58 69116 7ff71abf3c10 shared_ptr 47 API calls 69115->69116 69117 7ff71ac39a66 69116->69117 69118 7ff71abf3c10 shared_ptr 47 API calls 69117->69118 69119 7ff71ac39a74 69118->69119 69120 7ff71abf3c10 shared_ptr 47 API calls 69119->69120 69121 7ff71ac39a82 69120->69121 69121->68951 69128 7ff71abeb467 _Mpunct 69127->69128 69130 7ff71abeb473 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 69128->69130 69136 7ff71ac02970 51 API calls Concurrency::task_continuation_context::task_continuation_context 69128->69136 69132 7ff71abeb4ac Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock task type_info::_name_internal_method char_traits 69130->69132 69133 7ff71abeaff0 69130->69133 69132->69093 69137 7ff71abeaf60 69133->69137 69136->69130 69140 7ff71ac02a10 69137->69140 69145 7ff71abed180 69140->69145 69146 7ff71abed1b3 69145->69146 69147 7ff71abed1ae 69145->69147 69149 7ff71abeaef0 69146->69149 69156 7ff71ac02260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 69147->69156 69150 7ff71abeaf05 69149->69150 69151 7ff71abeaf01 69149->69151 69152 7ff71abeaf10 69150->69152 69153 7ff71abeaf1c 69150->69153 69151->69132 69157 7ff71abeb050 69152->69157 69165 7ff71abfeb90 69153->69165 69156->69146 69158 7ff71abeb073 69157->69158 69159 7ff71abeb078 69157->69159 69168 7ff71ac02260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 69158->69168 69161 7ff71abfeb90 allocator 4 API calls 69159->69161 69163 7ff71abeb083 69161->69163 69164 7ff71abeb0a4 69163->69164 69169 7ff71ae08fa4 47 API calls 2 library calls 69163->69169 69164->69151 69170 7ff71ae02bd0 69165->69170 69168->69159 69172 7ff71ae02bdb 69170->69172 69171 7ff71abfeba3 69171->69151 69172->69171 69174 7ff71ae02bfa 69172->69174 69179 7ff71ae1fffc 69172->69179 69177 7ff71ae02c05 69174->69177 69182 7ff71ade1810 69174->69182 69186 7ff71ae03960 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 69177->69186 69178 7ff71ae02c0b 69180 7ff71ae2003c std::ios_base::_Init EnterCriticalSection LeaveCriticalSection 69179->69180 69181 7ff71ae2000e 69180->69181 69181->69172 69183 7ff71ade181e std::bad_alloc::bad_alloc 69182->69183 69184 7ff71ae03da0 Concurrency::cancel_current_task RtlPcToFileHeader RaiseException 69183->69184 69185 7ff71ade182f 69184->69185 69186->69178 69192 7ff71ac3818f 69187->69192 69188 7ff71ac381c7 69191 7ff71abf3c10 shared_ptr 47 API calls 69188->69191 69193 7ff71ac381eb 69191->69193 69192->69188 69236 7ff71ac38200 47 API calls 69192->69236 69237 7ff71ac26690 51 API calls 69192->69237 69194 7ff71ac385c0 69193->69194 69195 7ff71ac385e9 Concurrency::details::WorkQueue::IsStructuredEmpty 69194->69195 69238 7ff71ac02d10 69195->69238 69197 7ff71ac38602 69198 7ff71ac39e60 69197->69198 69262 7ff71abf10b0 69198->69262 69200 7ff71abf3c10 shared_ptr 47 API calls 69201 7ff71ac39914 69200->69201 69203 7ff71ac38140 69201->69203 69202 7ff71ac39e90 Concurrency::details::HardwareAffinity::operator!= 69202->69200 69204 7ff71ac385c0 type_info::_name_internal_method 51 API calls 69203->69204 69205 7ff71ac3815d 69204->69205 69206 7ff71abf3c10 69205->69206 69273 7ff71ac02810 69206->69273 69208 7ff71abf3c23 Concurrency::details::HardwareAffinity::operator!= 69208->69106 69277 7ff71abf0f30 69209->69277 69211 7ff71ac389ff 69217 7ff71ac38b8e 69211->69217 69281 7ff71ac38110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69211->69281 69212 7ff71ac38ce7 std::_Throw_Cpp_error 69213 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 69212->69213 69214 7ff71ac38d0e 69213->69214 69216 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 69214->69216 69215 7ff71ac38cbf 69215->69212 69283 7ff71ac38110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69215->69283 69219 7ff71ac38d19 69216->69219 69217->69212 69217->69215 69282 7ff71ac38110 51 API calls Concurrency::task_continuation_context::task_continuation_context 69217->69282 69219->69111 69301 7ff71abfa5a0 69222->69301 69226 7ff71abf04d0 69308 7ff71abf83e0 69226->69308 69229 7ff71abf04f6 69231 7ff71abf3be0 69229->69231 69413 7ff71ac02760 69231->69413 69233 7ff71abf3bf3 Concurrency::details::HardwareAffinity::operator!= 69233->69115 69234->69111 69235->69111 69236->69192 69237->69192 69239 7ff71ac02dcf 69238->69239 69241 7ff71ac02d4e Concurrency::details::WorkQueue::IsStructuredEmpty type_info::_name_internal_method char_traits 69238->69241 69242 7ff71abede60 69239->69242 69241->69197 69243 7ff71abedea3 _Mpunct 69242->69243 69245 7ff71abedeb7 Concurrency::details::WorkQueue::IsStructuredEmpty task 69243->69245 69250 7ff71ac02970 51 API calls Concurrency::task_continuation_context::task_continuation_context 69243->69250 69246 7ff71abeaff0 _Mpunct 49 API calls 69245->69246 69247 7ff71abedf16 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock task type_info::_name_internal_method 69246->69247 69249 7ff71abedfb7 type_info::_name_internal_method 69247->69249 69251 7ff71abff3c0 69247->69251 69249->69241 69250->69245 69254 7ff71ac04850 69251->69254 69257 7ff71abebc30 69254->69257 69256 7ff71abff3ed 69256->69249 69258 7ff71abebc58 std::_Throw_Cpp_error 69257->69258 69259 7ff71abebc49 69257->69259 69258->69256 69261 7ff71abfea40 47 API calls _invalid_parameter_noinfo_noreturn 69259->69261 69261->69258 69263 7ff71abf10d2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl _aligned_msize 69262->69263 69266 7ff71abeb8d0 69263->69266 69265 7ff71abf1136 69265->69202 69267 7ff71abeb8f7 _Mpunct 69266->69267 69269 7ff71abeb906 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 69267->69269 69272 7ff71ac02970 51 API calls Concurrency::task_continuation_context::task_continuation_context 69267->69272 69270 7ff71abeaff0 _Mpunct 49 API calls 69269->69270 69271 7ff71abeb942 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock task type_info::_name_internal_method 69269->69271 69270->69271 69271->69265 69272->69269 69275 7ff71ac0282d Concurrency::details::WorkQueue::IsStructuredEmpty task 69273->69275 69274 7ff71ac02869 shared_ptr char_traits 69274->69208 69275->69274 69276 7ff71abff3c0 task 47 API calls 69275->69276 69276->69274 69278 7ff71abf0f57 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock _Mpunct char_traits 69277->69278 69284 7ff71abeb5d0 69278->69284 69280 7ff71abf0f7c 69280->69211 69281->69211 69282->69217 69283->69215 69285 7ff71abeb5f7 Concurrency::task_continuation_context::task_continuation_context 69284->69285 69287 7ff71abeb603 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error _Mpunct Concurrency::task_continuation_context::task_continuation_context 69285->69287 69293 7ff71ac02970 51 API calls Concurrency::task_continuation_context::task_continuation_context 69285->69293 69289 7ff71abeb63c Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock task type_info::_name_internal_method char_traits 69287->69289 69290 7ff71abeaf90 69287->69290 69289->69280 69294 7ff71abeaf30 69290->69294 69293->69287 69297 7ff71ac029b0 69294->69297 69298 7ff71ac029c8 allocator 69297->69298 69299 7ff71abeaef0 allocator 49 API calls 69298->69299 69300 7ff71abeaf50 69299->69300 69300->69289 69325 7ff71abfa620 69301->69325 69304 7ff71abf03d0 69305 7ff71abf03de 69304->69305 69305->69305 69307 7ff71abf041e UnDecorator::getVbTableType 69305->69307 69343 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69305->69343 69307->69226 69309 7ff71abf04e0 69308->69309 69310 7ff71abf83fb 69308->69310 69309->69229 69312 7ff71abf4f80 69309->69312 69310->69309 69344 7ff71abfa8e0 57 API calls 69310->69344 69313 7ff71abf4f96 69312->69313 69314 7ff71abf4fa0 69312->69314 69345 7ff71abfa4a0 69313->69345 69316 7ff71abf4fbd 69314->69316 69317 7ff71abf4ffa 69314->69317 69348 7ff71abfa510 69316->69348 69355 7ff71abf9650 RtlPcToFileHeader RaiseException std::ios_base::good UnDecorator::getVbTableType 69317->69355 69321 7ff71abf4ff7 69321->69229 69323 7ff71abf4fe9 69352 7ff71abfae00 69323->69352 69326 7ff71abfa68b 69325->69326 69327 7ff71abfa649 69325->69327 69329 7ff71abf04c3 69326->69329 69342 7ff71ae02efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 69326->69342 69341 7ff71ae02efc AcquireSRWLockExclusive SleepConditionVariableSRW ReleaseSRWLockExclusive 69327->69341 69329->69304 69343->69305 69344->69309 69356 7ff71abfebb0 69345->69356 69347 7ff71abfa4ae MultiByteToWideChar 69347->69314 69357 7ff71abfaa90 69348->69357 69351 7ff71abf8690 MultiByteToWideChar 69351->69323 69408 7ff71abfc0d0 69352->69408 69354 7ff71abfae1b 69354->69321 69355->69321 69356->69347 69358 7ff71abfaaa4 69357->69358 69360 7ff71abfaaae std::ios_base::good 69357->69360 69370 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69358->69370 69362 7ff71abf4fcb 69360->69362 69363 7ff71abfa9c0 69360->69363 69362->69351 69364 7ff71abfa9d7 strrchr std::ios_base::good 69363->69364 69365 7ff71abfaa07 69364->69365 69368 7ff71abfaa18 69364->69368 69371 7ff71abfa140 69365->69371 69367 7ff71abfaa15 69367->69362 69368->69367 69379 7ff71abfab10 RtlPcToFileHeader RaiseException std::ios_base::good UnDecorator::getVbTableType 69368->69379 69370->69360 69372 7ff71abfa157 std::ios_base::good 69371->69372 69380 7ff71abf7d90 69372->69380 69375 7ff71abfa1b8 UnDecorator::getVbTableType 69385 7ff71ac10d40 69375->69385 69377 7ff71abfa222 UnDecorator::getVbTableType 69377->69367 69379->69367 69382 7ff71abf7da2 69380->69382 69381 7ff71abf7dca 69381->69375 69384 7ff71abfea20 RtlPcToFileHeader RaiseException strrchr 69381->69384 69382->69381 69401 7ff71abf7f00 HeapAlloc 69382->69401 69384->69375 69386 7ff71ac10d67 69385->69386 69392 7ff71ac10d60 memcpy_s 69385->69392 69387 7ff71ac10d90 69386->69387 69391 7ff71ac10daa memcpy_s 69386->69391 69402 7ff71ae090f0 11 API calls _get_daylight 69387->69402 69389 7ff71ac10d95 69403 7ff71ae08f84 47 API calls _invalid_parameter_noinfo 69389->69403 69391->69392 69393 7ff71ac10dfd 69391->69393 69397 7ff71ac10e14 69391->69397 69392->69377 69404 7ff71ae090f0 11 API calls _get_daylight 69393->69404 69395 7ff71ac10e02 69405 7ff71ae08f84 47 API calls _invalid_parameter_noinfo 69395->69405 69397->69392 69406 7ff71ae090f0 11 API calls _get_daylight 69397->69406 69399 7ff71ac10e46 69407 7ff71ae08f84 47 API calls _invalid_parameter_noinfo 69399->69407 69401->69381 69402->69389 69403->69392 69404->69395 69405->69392 69406->69399 69407->69392 69409 7ff71abfc0e4 std::ios_base::good 69408->69409 69411 7ff71abfc101 std::ios_base::good 69409->69411 69412 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 69409->69412 69411->69354 69412->69411 69414 7ff71ac0277d Concurrency::details::WorkQueue::IsStructuredEmpty task 69413->69414 69416 7ff71ac027b9 shared_ptr char_traits 69414->69416 69417 7ff71abff380 47 API calls shared_ptr 69414->69417 69416->69233 69417->69416 69429 7ff71abfe340 69430 7ff71abfe395 69429->69430 69431 7ff71abfe36c 69429->69431 69432 7ff71abfe425 69430->69432 69433 7ff71abfe3a3 69430->69433 69435 7ff71abfe3b6 UnDecorator::getVbTableType 69431->69435 69439 7ff71abfe9ba PostQuitMessage 69431->69439 69440 7ff71abfe389 69431->69440 69437 7ff71abfe434 69432->69437 69438 7ff71abfe6dd 69432->69438 69434 7ff71abfe390 DefWindowProcW 69433->69434 69433->69435 69441 7ff71abfe414 69434->69441 69436 7ff71abfe9ec DefWindowProcW 69435->69436 69436->69441 69443 7ff71abf11a0 _Mpunct 51 API calls 69437->69443 69438->69435 69445 7ff71abf11a0 _Mpunct 51 API calls 69438->69445 69439->69436 69440->69434 69444 7ff71abfe3bb 69440->69444 69446 7ff71abfe458 69443->69446 69448 7ff71abfe3d3 PostMessageW 69444->69448 69449 7ff71abfe3ef 69444->69449 69450 7ff71abfe710 69445->69450 69447 7ff71ac398a0 71 API calls 69446->69447 69452 7ff71abfe472 69447->69452 69448->69441 69449->69441 69453 7ff71abfe3fa PostMessageW 69449->69453 69451 7ff71ac398a0 71 API calls 69450->69451 69454 7ff71abfe72d 69451->69454 69455 7ff71abf11a0 _Mpunct 51 API calls 69452->69455 69453->69441 69456 7ff71abf11a0 _Mpunct 51 API calls 69454->69456 69457 7ff71abfe497 69455->69457 69458 7ff71abfe752 69456->69458 69459 7ff71ac398a0 71 API calls 69457->69459 69460 7ff71ac398a0 71 API calls 69458->69460 69461 7ff71abfe4b1 69459->69461 69462 7ff71abfe76c 69460->69462 69463 7ff71abf11a0 _Mpunct 51 API calls 69461->69463 69464 7ff71abf11a0 _Mpunct 51 API calls 69462->69464 69465 7ff71abfe4d6 69463->69465 69466 7ff71abfe791 69464->69466 69467 7ff71ac398a0 71 API calls 69465->69467 69468 7ff71ac398a0 71 API calls 69466->69468 69469 7ff71abfe4f0 69467->69469 69470 7ff71abfe7ab 69468->69470 69505 7ff71abf0510 69469->69505 69472 7ff71abf0510 67 API calls 69470->69472 69474 7ff71abfe7bd 69472->69474 69476 7ff71abf0510 67 API calls 69474->69476 69475 7ff71abf0510 67 API calls 69477 7ff71abfe514 69475->69477 69478 7ff71abfe7cf 69476->69478 69479 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69477->69479 69480 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69478->69480 69481 7ff71abfe537 69479->69481 69483 7ff71abfe7f2 69480->69483 69514 7ff71ac38e90 69481->69514 69484 7ff71ac38e90 71 API calls 69483->69484 69486 7ff71abfe80f 69484->69486 69485 7ff71abfe554 69487 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69485->69487 69488 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69486->69488 69489 7ff71abfe59e 69487->69489 69490 7ff71abfe859 69488->69490 69491 7ff71ac38e90 71 API calls 69489->69491 69492 7ff71ac38e90 71 API calls 69490->69492 69493 7ff71abfe5bb 69491->69493 69494 7ff71abfe876 69492->69494 69495 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69493->69495 69496 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69494->69496 69497 7ff71abfe605 69495->69497 69498 7ff71abfe8c3 69496->69498 69499 7ff71ac38e90 71 API calls 69497->69499 69500 7ff71ac38e90 71 API calls 69498->69500 69501 7ff71abfe622 69499->69501 69502 7ff71abfe8e0 69500->69502 69547 7ff71ac7d350 89 API calls 4 library calls 69501->69547 69548 7ff71ac7d350 89 API calls 4 library calls 69502->69548 69506 7ff71abfa5a0 57 API calls 69505->69506 69507 7ff71abf0523 69506->69507 69508 7ff71abf03d0 2 API calls 69507->69508 69509 7ff71abf0530 69508->69509 69510 7ff71abf83e0 57 API calls 69509->69510 69511 7ff71abf0540 69510->69511 69512 7ff71abf0556 69511->69512 69549 7ff71abf5010 50 API calls UnDecorator::getVbTableType 69511->69549 69512->69475 69515 7ff71ac38eb6 shared_ptr 69514->69515 69516 7ff71abf11a0 _Mpunct 51 API calls 69515->69516 69517 7ff71ac38ec6 69516->69517 69518 7ff71abf3c10 shared_ptr 47 API calls 69517->69518 69521 7ff71ac38eea shared_ptr 69518->69521 69520 7ff71ac38fab 69522 7ff71ac38fbc 69520->69522 69528 7ff71ac39007 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 69520->69528 69550 7ff71ac38610 69521->69550 69562 7ff71abf05d0 69522->69562 69527 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 69546 7ff71ac38fec UnDecorator::getVbTableType 69527->69546 69570 7ff71abe97a0 51 API calls 4 library calls 69528->69570 69530 7ff71ac3909d Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 69571 7ff71abe97a0 51 API calls 4 library calls 69530->69571 69532 7ff71ac39152 69533 7ff71ac39e60 51 API calls 69532->69533 69534 7ff71ac39170 Concurrency::details::WorkQueue::IsStructuredEmpty 69533->69534 69535 7ff71abf0510 67 API calls 69534->69535 69536 7ff71ac391a5 69535->69536 69537 7ff71abf3c10 shared_ptr 47 API calls 69536->69537 69538 7ff71ac391bd 69537->69538 69539 7ff71abf3c10 shared_ptr 47 API calls 69538->69539 69540 7ff71ac391cb 69539->69540 69541 7ff71abf3c10 shared_ptr 47 API calls 69540->69541 69542 7ff71ac391d9 69541->69542 69543 7ff71ac37fa0 47 API calls 69542->69543 69544 7ff71ac391e4 69543->69544 69545 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 69544->69545 69545->69546 69546->69485 69547->69435 69548->69435 69549->69512 69551 7ff71abf0f30 _Mpunct 51 API calls 69550->69551 69558 7ff71ac3863a Concurrency::details::HardwareAffinity::operator!= 69551->69558 69552 7ff71ac38981 69553 7ff71ac37fa0 47 API calls 69552->69553 69555 7ff71ac389a8 69553->69555 69554 7ff71ac38838 69554->69552 69574 7ff71ac39e00 51 API calls 69554->69574 69557 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 69555->69557 69559 7ff71ac389b3 69557->69559 69558->69554 69572 7ff71ac39d60 50 API calls 69558->69572 69573 7ff71ac39e00 51 API calls 69558->69573 69559->69520 69563 7ff71abfa5a0 57 API calls 69562->69563 69564 7ff71abf05de 69563->69564 69565 7ff71abf03d0 2 API calls 69564->69565 69566 7ff71abf05eb 69565->69566 69567 7ff71ac37fa0 69566->69567 69575 7ff71ac384f0 69567->69575 69570->69530 69571->69532 69572->69558 69573->69558 69574->69554 69576 7ff71ac38503 Concurrency::details::WorkQueue::IsStructuredEmpty task 69575->69576 69577 7ff71ac37fb3 69576->69577 69578 7ff71ac04850 task 47 API calls 69576->69578 69577->69527 69578->69577 69579 7ff71ac251f0 69582 7ff71ac24ef0 69579->69582 69581 7ff71ac251fc 69585 7ff71ac24e70 69582->69585 69586 7ff71ac24e96 std::bad_exception::bad_exception 69585->69586 69593 7ff71abf2c70 69586->69593 69621 7ff71ade13e8 69593->69621 69595 7ff71abf2c94 _Yarn 69596 7ff71abf2d1b 69595->69596 69597 7ff71abf2d09 69595->69597 69626 7ff71ade18e0 51 API calls 2 library calls 69596->69626 69625 7ff71ade200c 18 API calls std::_Locinfo::_Locinfo_ctor 69597->69625 69600 7ff71abf2d18 69601 7ff71ac273c0 69600->69601 69628 7ff71ac00020 69601->69628 69604 7ff71abf4b10 69702 7ff71ade2078 69604->69702 69609 7ff71abf3a50 std::bad_exception::bad_exception 13 API calls 69610 7ff71abf4b46 69609->69610 69611 7ff71abf3a50 std::bad_exception::bad_exception 13 API calls 69610->69611 69612 7ff71abf4b57 69611->69612 69613 7ff71abf3a50 std::bad_exception::bad_exception 13 API calls 69612->69613 69614 7ff71abf4b68 69613->69614 69615 7ff71abf3a50 std::bad_exception::bad_exception 13 API calls 69614->69615 69616 7ff71abf4b79 69615->69616 69617 7ff71abf3a50 std::bad_exception::bad_exception 13 API calls 69616->69617 69618 7ff71abf4b8a 69617->69618 69709 7ff71ade1460 69618->69709 69620 7ff71abf4b97 69620->69581 69622 7ff71ade13f7 69621->69622 69624 7ff71ade13fc 69621->69624 69627 7ff71ae1a794 6 API calls std::_Lockit::_Lockit 69622->69627 69624->69595 69626->69600 69631 7ff71ade2390 69628->69631 69640 7ff71ae1ab18 69631->69640 69639 7ff71ac0003a 69639->69604 69656 7ff71ae209fc GetLastError 69640->69656 69645 7ff71ae1abac 69646 7ff71ae209fc _Getcoll 47 API calls 69645->69646 69647 7ff71ae1abb5 69646->69647 69648 7ff71ae20e70 _Getcoll 47 API calls 69647->69648 69649 7ff71ade23bc 69648->69649 69650 7ff71ae1ab78 69649->69650 69651 7ff71ae209fc _Getcoll 47 API calls 69650->69651 69652 7ff71ae1ab81 69651->69652 69653 7ff71ae20e70 _Getcoll 47 API calls 69652->69653 69654 7ff71ade23c4 69653->69654 69654->69639 69655 7ff71ae1aae8 47 API calls _Getcoll 69654->69655 69655->69639 69657 7ff71ae20a3d FlsSetValue 69656->69657 69658 7ff71ae20a20 FlsGetValue 69656->69658 69660 7ff71ae20a4f 69657->69660 69675 7ff71ae20a2d 69657->69675 69659 7ff71ae20a37 69658->69659 69658->69675 69659->69657 69682 7ff71ae20d5c 69660->69682 69661 7ff71ae20aa9 SetLastError 69663 7ff71ae20ac9 69661->69663 69664 7ff71ae1ab21 69661->69664 69698 7ff71ae0fd98 47 API calls __std_fs_directory_iterator_open 69663->69698 69678 7ff71ae20e70 69664->69678 69667 7ff71ae20a7c FlsSetValue 69670 7ff71ae20a88 FlsSetValue 69667->69670 69671 7ff71ae20a9a 69667->69671 69668 7ff71ae20a6c FlsSetValue 69669 7ff71ae20a75 69668->69669 69691 7ff71ae20dd4 69669->69691 69670->69669 69697 7ff71ae207ac 11 API calls _Getcoll 69671->69697 69675->69661 69676 7ff71ae20aa2 69677 7ff71ae20dd4 __free_lconv_mon 11 API calls 69676->69677 69677->69661 69679 7ff71ae20e85 69678->69679 69681 7ff71ade23b5 69678->69681 69679->69681 69701 7ff71ae2d80c 47 API calls 2 library calls 69679->69701 69681->69645 69683 7ff71ae20d6d 69682->69683 69689 7ff71ae20d7b _Getcoll 69682->69689 69684 7ff71ae20dbe 69683->69684 69683->69689 69699 7ff71ae090f0 11 API calls _get_daylight 69684->69699 69685 7ff71ae20da2 HeapAlloc 69686 7ff71ae20dbc 69685->69686 69685->69689 69688 7ff71ae20a5e 69686->69688 69688->69667 69688->69668 69689->69684 69689->69685 69690 7ff71ae1fffc std::ios_base::_Init 2 API calls 69689->69690 69690->69689 69692 7ff71ae20dd9 RtlFreeHeap 69691->69692 69693 7ff71ae20e0a 69691->69693 69692->69693 69694 7ff71ae20df4 GetLastError 69692->69694 69693->69675 69695 7ff71ae20e01 __free_lconv_mon 69694->69695 69700 7ff71ae090f0 11 API calls _get_daylight 69695->69700 69697->69676 69699->69688 69700->69693 69701->69681 69703 7ff71ade2085 69702->69703 69704 7ff71abf4b23 69702->69704 69713 7ff71ae1aa9c 7 API calls 2 library calls 69703->69713 69706 7ff71abf3a50 69704->69706 69714 7ff71ac02360 69706->69714 69710 7ff71ade146b LeaveCriticalSection 69709->69710 69712 7ff71ade1474 69709->69712 69712->69620 69713->69704 69715 7ff71ac02374 69714->69715 69716 7ff71abf3a63 69714->69716 69718 7ff71ae09ad0 13 API calls 2 library calls 69715->69718 69716->69609 69718->69716 69719 7ff71ac442b0 69722 7ff71ae1689c 69719->69722 69723 7ff71ae168b8 69722->69723 69724 7ff71ae168d6 69722->69724 69744 7ff71ae090f0 11 API calls _get_daylight 69723->69744 69743 7ff71ae16450 EnterCriticalSection 69724->69743 69727 7ff71ae168bd 69745 7ff71ae08f84 47 API calls _invalid_parameter_noinfo 69727->69745 69741 7ff71ac442c8 69744->69727 69745->69741 69746 7ff71ac5c490 GetWindowTextW 69747 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69746->69747 69748 7ff71ac5c4eb 69747->69748 69749 7ff71ac38e90 71 API calls 69748->69749 69750 7ff71ac5c4ff type_info::_name_internal_method shared_ptr 69749->69750 69751 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69750->69751 69755 7ff71ac5c569 type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 69750->69755 69752 7ff71ac5c555 69751->69752 69753 7ff71ac38e90 71 API calls 69752->69753 69753->69755 69754 7ff71ac5c63e 69755->69754 69756 7ff71abf11a0 _Mpunct 51 API calls 69755->69756 69757 7ff71ac5c613 69756->69757 69761 7ff71ac58130 51 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 69757->69761 69759 7ff71ac5c626 69760 7ff71abf3c10 shared_ptr 47 API calls 69759->69760 69760->69754 69761->69759 69762 7ff71abe1270 69763 7ff71abf11a0 _Mpunct 51 API calls 69762->69763 69764 7ff71abe128f 69763->69764 69765 7ff71ac398a0 71 API calls 69764->69765 69766 7ff71abe12a3 shared_ptr 69765->69766 69767 7ff71abf11a0 _Mpunct 51 API calls 69766->69767 69768 7ff71abe12cb UnDecorator::getVbTableType 69767->69768 69771 7ff71ae02e3c 50 API calls 69768->69771 69770 7ff71abe12e3 69771->69770 69772 7ff71abfc290 69773 7ff71abfc2a8 ctype 69772->69773 70099 7ff71ac0a0d0 69773->70099 69775 7ff71abfc2b8 70176 7ff71ac0d500 69775->70176 69778 7ff71abf11a0 _Mpunct 51 API calls 69779 7ff71abfc2ef 69778->69779 69780 7ff71ac398a0 71 API calls 69779->69780 69781 7ff71abfc309 69780->69781 69782 7ff71abf11a0 _Mpunct 51 API calls 69781->69782 69783 7ff71abfc32e 69782->69783 69784 7ff71ac398a0 71 API calls 69783->69784 69785 7ff71abfc348 69784->69785 69786 7ff71abf11a0 _Mpunct 51 API calls 69785->69786 69787 7ff71abfc36d 69786->69787 69788 7ff71ac398a0 71 API calls 69787->69788 69789 7ff71abfc387 69788->69789 69790 7ff71abf11a0 _Mpunct 51 API calls 69789->69790 69791 7ff71abfc3ac 69790->69791 69792 7ff71ac398a0 71 API calls 69791->69792 69793 7ff71abfc3c6 69792->69793 69794 7ff71abf11a0 _Mpunct 51 API calls 69793->69794 69795 7ff71abfc3eb 69794->69795 69796 7ff71ac398a0 71 API calls 69795->69796 69797 7ff71abfc405 69796->69797 69798 7ff71abf11a0 _Mpunct 51 API calls 69797->69798 69799 7ff71abfc42a 69798->69799 69800 7ff71ac398a0 71 API calls 69799->69800 69801 7ff71abfc447 shared_ptr 69800->69801 69802 7ff71abf11a0 _Mpunct 51 API calls 69801->69802 69803 7ff71abfc47c UnDecorator::getVbTableType 69802->69803 69804 7ff71abf11a0 _Mpunct 51 API calls 69803->69804 69805 7ff71abfc4af 69804->69805 69806 7ff71ac398a0 71 API calls 69805->69806 69807 7ff71abfc4c9 69806->69807 69808 7ff71abf05d0 59 API calls 69807->69808 69809 7ff71abfc4d4 69808->69809 70200 7ff71ac5a6b0 69809->70200 69811 7ff71abfc4e2 shared_ptr 70216 7ff71abfa250 69811->70216 69813 7ff71abfc54c UnDecorator::getVbTableType 69814 7ff71abf0510 67 API calls 69813->69814 69815 7ff71abfc56f 69814->69815 69816 7ff71abf0510 67 API calls 69815->69816 69817 7ff71abfc584 69816->69817 69818 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69817->69818 69819 7ff71abfc5a7 69818->69819 69820 7ff71ac38e90 71 API calls 69819->69820 69821 7ff71abfc5c4 69820->69821 69822 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 69821->69822 69823 7ff71abfc60e 69822->69823 69824 7ff71ac38e90 71 API calls 69823->69824 69825 7ff71abfc62b 69824->69825 70219 7ff71ac7ca30 69825->70219 69827 7ff71abfc682 UnDecorator::getVbTableType 70240 7ff71abe8ad0 69827->70240 70100 7ff71ac062c0 74 API calls 70099->70100 70101 7ff71ac0a0e9 70100->70101 70102 7ff71abf11a0 _Mpunct 51 API calls 70101->70102 70175 7ff71ac0a6b2 UnDecorator::getVbTableType 70101->70175 70103 7ff71ac0a11c 70102->70103 70104 7ff71ac398a0 71 API calls 70103->70104 70105 7ff71ac0a136 70104->70105 70106 7ff71abf11a0 _Mpunct 51 API calls 70105->70106 70107 7ff71ac0a15b 70106->70107 70108 7ff71ac398a0 71 API calls 70107->70108 70109 7ff71ac0a175 70108->70109 70110 7ff71abf05d0 59 API calls 70109->70110 70111 7ff71ac0a180 70110->70111 70112 7ff71abf05d0 59 API calls 70111->70112 70113 7ff71ac0a18b 70112->70113 70114 7ff71ac0a1ab 70113->70114 70115 7ff71ac0a19b 70113->70115 70118 7ff71abf11a0 _Mpunct 51 API calls 70114->70118 70116 7ff71ac0a22a 70115->70116 70117 7ff71ac0a1a6 70115->70117 70119 7ff71abf11a0 _Mpunct 51 API calls 70116->70119 70122 7ff71abf05d0 59 API calls 70117->70122 70120 7ff71ac0a1cf 70118->70120 70121 7ff71ac0a24e 70119->70121 70123 7ff71ac398a0 71 API calls 70120->70123 70124 7ff71ac398a0 71 API calls 70121->70124 70125 7ff71ac0a2b3 70122->70125 70126 7ff71ac0a1ec 70123->70126 70127 7ff71ac0a26b 70124->70127 70128 7ff71abf11a0 _Mpunct 51 API calls 70125->70128 71086 7ff71abf4f50 70126->71086 70130 7ff71abf4f50 UnDecorator::getVbTableType 50 API calls 70127->70130 70131 7ff71ac0a2d8 70128->70131 70135 7ff71ac0a216 UnDecorator::getVbTableType 70130->70135 70132 7ff71ac398a0 71 API calls 70131->70132 70133 7ff71ac0a2f5 70132->70133 70134 7ff71abf4f50 UnDecorator::getVbTableType 50 API calls 70133->70134 70136 7ff71ac0a31f UnDecorator::getVbTableType 70134->70136 70137 7ff71abf11a0 _Mpunct 51 API calls 70135->70137 70140 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70136->70140 70138 7ff71ac0a46f 70137->70138 70139 7ff71ac398a0 71 API calls 70138->70139 70141 7ff71ac0a489 70139->70141 70142 7ff71ac0a350 70140->70142 70143 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70141->70143 70145 7ff71ac38e90 71 API calls 70142->70145 70144 7ff71ac0a4ac 70143->70144 70146 7ff71ac38e90 71 API calls 70144->70146 70147 7ff71ac0a36d shared_ptr 70145->70147 70148 7ff71ac0a4c9 70146->70148 70151 7ff71abfa250 69 API calls 70147->70151 70149 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70148->70149 70150 7ff71ac0a516 70149->70150 70152 7ff71ac38e90 71 API calls 70150->70152 70154 7ff71ac0a3a4 shared_ptr UnDecorator::getVbTableType 70151->70154 70153 7ff71ac0a533 shared_ptr 70152->70153 70155 7ff71abfa250 69 API calls 70153->70155 70156 7ff71abf11a0 _Mpunct 51 API calls 70154->70156 70160 7ff71ac0a57a UnDecorator::getVbTableType 70155->70160 70157 7ff71ac0a3dd 70156->70157 70158 7ff71ac398a0 71 API calls 70157->70158 70159 7ff71ac0a3fa 70158->70159 70161 7ff71abf4f50 UnDecorator::getVbTableType 50 API calls 70159->70161 70162 7ff71abf0510 67 API calls 70160->70162 70161->70135 70163 7ff71ac0a5a8 70162->70163 70164 7ff71abf0510 67 API calls 70163->70164 70165 7ff71ac0a5ba 70164->70165 70166 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70165->70166 70167 7ff71ac0a5dd 70166->70167 70168 7ff71ac38e90 71 API calls 70167->70168 70169 7ff71ac0a5fa 70168->70169 70170 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70169->70170 70171 7ff71ac0a644 70170->70171 70172 7ff71ac38e90 71 API calls 70171->70172 70173 7ff71ac0a661 70172->70173 70174 7ff71ac7ca30 76 API calls 70173->70174 70174->70175 70175->69775 70177 7ff71abf11a0 _Mpunct 51 API calls 70176->70177 70178 7ff71ac0d52e 70177->70178 70179 7ff71ac398a0 71 API calls 70178->70179 70180 7ff71ac0d542 shared_ptr 70179->70180 70181 7ff71abf11a0 _Mpunct 51 API calls 70180->70181 70182 7ff71ac0d56b UnDecorator::getVbTableType 70181->70182 70183 7ff71abf11a0 _Mpunct 51 API calls 70182->70183 70184 7ff71ac0d595 70183->70184 70185 7ff71ac398a0 71 API calls 70184->70185 70186 7ff71ac0d5b2 shared_ptr 70185->70186 70187 7ff71abf11a0 _Mpunct 51 API calls 70186->70187 70188 7ff71ac0d5e7 UnDecorator::getVbTableType 70187->70188 70189 7ff71ac0d5f5 GetModuleFileNameW 70188->70189 70190 7ff71abf10b0 51 API calls 70189->70190 70191 7ff71ac0d632 shared_ptr 70190->70191 70192 7ff71ac0d664 RegOpenKeyExW 70191->70192 70193 7ff71ac0d698 UnDecorator::getVbTableType 70192->70193 70194 7ff71ac0d6a0 RegSetValueExW RegCloseKey 70193->70194 70195 7ff71ac0d705 70193->70195 70194->70195 70196 7ff71abf3c10 shared_ptr 47 API calls 70195->70196 70197 7ff71ac0d712 70196->70197 70198 7ff71abf3c10 shared_ptr 47 API calls 70197->70198 70199 7ff71abfc2ca 70198->70199 70199->69778 70201 7ff71abf05d0 59 API calls 70200->70201 70202 7ff71ac5a6ce 70201->70202 71097 7ff71abfa530 70202->71097 70205 7ff71ac5a70b 70207 7ff71abf11a0 _Mpunct 51 API calls 70205->70207 70206 7ff71ac5a796 70208 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70206->70208 70209 7ff71ac5a726 70207->70209 70212 7ff71ac5a76b UnDecorator::getVbTableType 70208->70212 70210 7ff71ac398a0 71 API calls 70209->70210 70211 7ff71ac5a73a 70210->70211 70213 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70211->70213 70212->69811 70214 7ff71ac5a754 70213->70214 70215 7ff71ac38e90 71 API calls 70214->70215 70215->70212 71101 7ff71abfa320 70216->71101 70218 7ff71abfa286 70218->69813 71192 7ff71ac6f060 70219->71192 70221 7ff71ac7ca55 shared_ptr 70239 7ff71ac7ca84 70221->70239 71195 7ff71ac7d4d0 51 API calls Concurrency::cancellation_token::_FromImpl 70221->71195 70223 7ff71ac7caa5 Concurrency::details::WorkQueue::IsStructuredEmpty 70224 7ff71abf0510 67 API calls 70223->70224 70225 7ff71ac7cacb 70224->70225 70226 7ff71abf3c10 shared_ptr 47 API calls 70225->70226 70227 7ff71ac7cad9 70226->70227 70228 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70227->70228 70229 7ff71ac7caec 70228->70229 70230 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70229->70230 70231 7ff71ac7caff 70230->70231 70232 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70231->70232 70233 7ff71ac7cb12 70232->70233 70234 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70233->70234 70235 7ff71ac7cb25 70234->70235 70236 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 70235->70236 70237 7ff71ac7cb38 70236->70237 71196 7ff71ac3bb30 58 API calls Concurrency::details::WorkQueue::IsStructuredEmpty 70237->71196 70239->69827 70241 7ff71abe8aed Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 70240->70241 71203 7ff71abeec10 70241->71203 70243 7ff71abe8b15 70244 7ff71ac048d0 70243->70244 70245 7ff71ac048e5 70244->70245 70246 7ff71ac048f6 70245->70246 71244 7ff71ade1c68 51 API calls 3 library calls 70245->71244 71089 7ff71abf4e50 71086->71089 71088 7ff71abf4f6d 71088->70135 71090 7ff71abf4e68 std::ios_base::good UnDecorator::getVbTableType 71089->71090 71091 7ff71abf4ee0 UnDecorator::getVbTableType 71090->71091 71092 7ff71abf4ee3 71090->71092 71094 7ff71abf4eaf std::ios_base::good shared_ptr 71090->71094 71091->71088 71093 7ff71abf8440 UnDecorator::getVbTableType 49 API calls 71092->71093 71093->71091 71096 7ff71abfc180 50 API calls 4 library calls 71094->71096 71096->71091 71098 7ff71abfa543 strrchr std::ios_base::good 71097->71098 71099 7ff71abfa56b GetUserDefaultUILanguage LCIDToLocaleName 71098->71099 71100 7ff71abfa140 strrchr 50 API calls 71098->71100 71099->70205 71099->70206 71100->71099 71102 7ff71abfa345 71101->71102 71103 7ff71abfa33b 71101->71103 71119 7ff71abfa5b0 71102->71119 71138 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71103->71138 71107 7ff71abfa36a 71123 7ff71abfa780 71107->71123 71113 7ff71abfa510 strrchr 50 API calls 71114 7ff71abfa396 shared_ptr 71113->71114 71134 7ff71abfa2a0 71114->71134 71117 7ff71abfae00 UnDecorator::getVbTableType 2 API calls 71118 7ff71abfa3d1 UnDecorator::getVbTableType 71117->71118 71118->70218 71120 7ff71abfa5c3 _vswprintf_s_l 71119->71120 71140 7ff71ae0f358 71120->71140 71124 7ff71abfa793 71123->71124 71125 7ff71abfa5a0 57 API calls 71124->71125 71126 7ff71abfa375 71124->71126 71125->71126 71127 7ff71abf0570 71126->71127 71128 7ff71abf03d0 2 API calls 71127->71128 71129 7ff71abf0592 71128->71129 71130 7ff71abf83e0 57 API calls 71129->71130 71131 7ff71abf05a2 71130->71131 71132 7ff71abf05b8 71131->71132 71177 7ff71abf5010 50 API calls UnDecorator::getVbTableType 71131->71177 71132->71113 71135 7ff71abfa2bd _vswprintf_s_l 71134->71135 71178 7ff71ae0f5b4 71135->71178 71138->71102 71139 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 71139->71107 71143 7ff71ae0f3b2 71140->71143 71141 7ff71ae0f3d7 71171 7ff71ae08eb8 47 API calls 2 library calls 71141->71171 71143->71141 71144 7ff71ae0f413 71143->71144 71172 7ff71ae0cdb4 50 API calls _invalid_parameter_noinfo 71144->71172 71146 7ff71ae0f401 71149 7ff71ae0f575 71146->71149 71173 7ff71ae08b98 47 API calls 2 library calls 71146->71173 71148 7ff71ae0f58b 71162 7ff71ae031a0 71148->71162 71149->71148 71174 7ff71ae08b98 47 API calls 2 library calls 71149->71174 71150 7ff71ae0f4ae 71151 7ff71ae0f4f4 71150->71151 71156 7ff71ae0f4c9 71150->71156 71157 7ff71ae0f51a 71150->71157 71160 7ff71ae0f4c0 71150->71160 71153 7ff71ae20dd4 __free_lconv_mon 11 API calls 71151->71153 71153->71146 71159 7ff71ae20dd4 __free_lconv_mon 11 API calls 71156->71159 71157->71151 71158 7ff71ae0f524 71157->71158 71161 7ff71ae20dd4 __free_lconv_mon 11 API calls 71158->71161 71159->71146 71160->71151 71160->71156 71161->71146 71163 7ff71ae031a9 71162->71163 71164 7ff71abfa355 71163->71164 71165 7ff71ae039c4 IsProcessorFeaturePresent 71163->71165 71164->71107 71164->71139 71166 7ff71ae039dc 71165->71166 71175 7ff71ae03bbc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 71166->71175 71168 7ff71ae039ef 71176 7ff71ae03990 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 71168->71176 71171->71146 71172->71150 71173->71149 71174->71148 71175->71168 71177->71132 71179 7ff71ae0f5ed 71178->71179 71183 7ff71ae0f630 71179->71183 71188 7ff71ae09cdc 50 API calls 3 library calls 71179->71188 71182 7ff71ae0f66f 71186 7ff71ae0f695 71182->71186 71190 7ff71ae08b98 47 API calls 2 library calls 71182->71190 71183->71182 71189 7ff71ae08eb8 47 API calls 2 library calls 71183->71189 71185 7ff71abfa2ee 71185->71117 71186->71185 71191 7ff71ae08b98 47 API calls 2 library calls 71186->71191 71188->71183 71189->71182 71190->71186 71191->71185 71197 7ff71ade1990 71192->71197 71194 7ff71ac6f06e _Subatomic 71194->70221 71195->70223 71196->70239 71200 7ff71ade7b24 71197->71200 71201 7ff71ade199e 71200->71201 71202 7ff71ade7b40 GetSystemTimeAsFileTime 71200->71202 71201->71194 71204 7ff71abeec30 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 71203->71204 71211 7ff71abefc90 71204->71211 71206 7ff71abeec58 shared_ptr 71214 7ff71ae0fc38 71206->71214 71209 7ff71abeecb3 type_info::_name_internal_method 71209->70243 71212 7ff71ae02bd0 std::ios_base::_Init 4 API calls 71211->71212 71213 7ff71abefcb5 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock type_info::_name_internal_method 71212->71213 71213->71206 71215 7ff71ae0fc58 71214->71215 71216 7ff71ae0fc6f 71214->71216 71240 7ff71ae090f0 11 API calls _get_daylight 71215->71240 71233 7ff71ae0fb0c 71216->71233 71220 7ff71ae0fc5d 71241 7ff71ae08f84 47 API calls _invalid_parameter_noinfo 71220->71241 71221 7ff71ae0fc82 CreateThread 71223 7ff71ae0fcb2 GetLastError 71221->71223 71224 7ff71abeeca0 71221->71224 71224->71209 71232 7ff71ade1c68 51 API calls 3 library calls 71224->71232 71234 7ff71ae20d5c _Getcoll 11 API calls 71233->71234 71235 7ff71ae0fb2e 71234->71235 71236 7ff71ae20dd4 __free_lconv_mon 11 API calls 71235->71236 71237 7ff71ae0fb38 71236->71237 71238 7ff71ae0fb3d 71237->71238 71239 7ff71ae0fb41 GetModuleHandleExW 71237->71239 71238->71221 71238->71224 71239->71238 71240->71220 71241->71224 73316 7ff71abf97d0 73317 7ff71abf11a0 _Mpunct 51 API calls 73316->73317 73318 7ff71abf980e 73317->73318 73319 7ff71ac398a0 71 API calls 73318->73319 73320 7ff71abf9825 shared_ptr 73319->73320 73321 7ff71abf11a0 _Mpunct 51 API calls 73320->73321 73322 7ff71abf985a UnDecorator::getVbTableType 73321->73322 73323 7ff71abf11a0 _Mpunct 51 API calls 73322->73323 73324 7ff71abf988d 73323->73324 73325 7ff71ac398a0 71 API calls 73324->73325 73326 7ff71abf98aa shared_ptr 73325->73326 73327 7ff71abf11a0 _Mpunct 51 API calls 73326->73327 73328 7ff71abf98dc UnDecorator::getVbTableType 73327->73328 73329 7ff71abf11a0 _Mpunct 51 API calls 73328->73329 73330 7ff71abf990f 73329->73330 73331 7ff71ac398a0 71 API calls 73330->73331 73332 7ff71abf992c shared_ptr 73331->73332 73333 7ff71abf11a0 _Mpunct 51 API calls 73332->73333 73334 7ff71abf9961 UnDecorator::getVbTableType 73333->73334 73335 7ff71abf11a0 _Mpunct 51 API calls 73334->73335 73336 7ff71abf9994 73335->73336 73337 7ff71ac398a0 71 API calls 73336->73337 73338 7ff71abf99b1 shared_ptr 73337->73338 73339 7ff71abf11a0 _Mpunct 51 API calls 73338->73339 73340 7ff71abf99e6 UnDecorator::getVbTableType 73339->73340 73341 7ff71abf11a0 _Mpunct 51 API calls 73340->73341 73342 7ff71abf9a19 73341->73342 73343 7ff71ac398a0 71 API calls 73342->73343 73344 7ff71abf9a36 shared_ptr 73343->73344 73345 7ff71abf11a0 _Mpunct 51 API calls 73344->73345 73346 7ff71abf9a6b UnDecorator::getVbTableType 73345->73346 73347 7ff71abf9a79 GetClassNameW 73346->73347 73348 7ff71abf9b59 73347->73348 73349 7ff71abf9ae7 GetWindowTextW 73347->73349 73350 7ff71abf10b0 51 API calls 73348->73350 73349->73348 73351 7ff71abf9b06 73349->73351 73361 7ff71abf9b7e type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 73350->73361 73352 7ff71abf3c10 shared_ptr 47 API calls 73351->73352 73353 7ff71abf9b1b 73352->73353 73354 7ff71abf3c10 shared_ptr 47 API calls 73353->73354 73355 7ff71abf9b29 73354->73355 73356 7ff71abf3c10 shared_ptr 47 API calls 73355->73356 73357 7ff71abf9b37 73356->73357 73358 7ff71abf3c10 shared_ptr 47 API calls 73357->73358 73359 7ff71abf9b42 73358->73359 73360 7ff71abf3c10 shared_ptr 47 API calls 73359->73360 73362 7ff71abf9b50 73360->73362 73363 7ff71abf9cad 73361->73363 73364 7ff71abf9bf9 EnumChildWindows EnumChildWindows EnumChildWindows 73361->73364 73366 7ff71abf10b0 51 API calls 73363->73366 73375 7ff71abf9cde type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 73363->73375 73365 7ff71abf3c10 shared_ptr 47 API calls 73364->73365 73367 7ff71abf9c6f 73365->73367 73366->73375 73368 7ff71abf3c10 shared_ptr 47 API calls 73367->73368 73369 7ff71abf9c7d 73368->73369 73370 7ff71abf3c10 shared_ptr 47 API calls 73369->73370 73371 7ff71abf9c8b 73370->73371 73376 7ff71abf3c10 shared_ptr 47 API calls 73371->73376 73372 7ff71abf10b0 51 API calls 73377 7ff71abf9d84 type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 73372->73377 73373 7ff71abf9e35 73378 7ff71abf3c10 shared_ptr 47 API calls 73373->73378 73374 7ff71abf9e97 73380 7ff71abf10b0 51 API calls 73374->73380 73392 7ff71abf9ecb type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 73374->73392 73375->73372 73375->73377 73379 7ff71abf9c96 73376->73379 73377->73373 73377->73374 73381 7ff71abf9e59 73378->73381 73382 7ff71abf3c10 shared_ptr 47 API calls 73379->73382 73380->73392 73383 7ff71abf3c10 shared_ptr 47 API calls 73381->73383 73382->73362 73386 7ff71abf9e67 73383->73386 73384 7ff71abf9fc0 73390 7ff71abf10b0 51 API calls 73384->73390 73404 7ff71abf9ff4 type_info::_name_internal_method shared_ptr UnDecorator::getVbTableType 73384->73404 73385 7ff71abf9f5e 73387 7ff71abf3c10 shared_ptr 47 API calls 73385->73387 73388 7ff71abf3c10 shared_ptr 47 API calls 73386->73388 73391 7ff71abf9f82 73387->73391 73389 7ff71abf9e75 73388->73389 73393 7ff71abf3c10 shared_ptr 47 API calls 73389->73393 73390->73404 73394 7ff71abf3c10 shared_ptr 47 API calls 73391->73394 73392->73384 73392->73385 73395 7ff71abf9e80 73393->73395 73398 7ff71abf9f90 73394->73398 73399 7ff71abf3c10 shared_ptr 47 API calls 73395->73399 73396 7ff71abfa0e6 73402 7ff71abf3c10 shared_ptr 47 API calls 73396->73402 73397 7ff71abfa087 73400 7ff71abf3c10 shared_ptr 47 API calls 73397->73400 73401 7ff71abf3c10 shared_ptr 47 API calls 73398->73401 73399->73362 73403 7ff71abfa0ab 73400->73403 73405 7ff71abf9f9e 73401->73405 73406 7ff71abfa0fb 73402->73406 73408 7ff71abf3c10 shared_ptr 47 API calls 73403->73408 73404->73396 73404->73397 73409 7ff71abf3c10 shared_ptr 47 API calls 73405->73409 73407 7ff71abf3c10 shared_ptr 47 API calls 73406->73407 73410 7ff71abfa109 73407->73410 73411 7ff71abfa0b9 73408->73411 73412 7ff71abf9fa9 73409->73412 73413 7ff71abf3c10 shared_ptr 47 API calls 73410->73413 73414 7ff71abf3c10 shared_ptr 47 API calls 73411->73414 73415 7ff71abf3c10 shared_ptr 47 API calls 73412->73415 73416 7ff71abfa117 73413->73416 73417 7ff71abfa0c7 73414->73417 73415->73362 73418 7ff71abf3c10 shared_ptr 47 API calls 73416->73418 73419 7ff71abf3c10 shared_ptr 47 API calls 73417->73419 73420 7ff71abfa122 73418->73420 73421 7ff71abfa0d2 73419->73421 73422 7ff71abf3c10 shared_ptr 47 API calls 73420->73422 73423 7ff71abf3c10 shared_ptr 47 API calls 73421->73423 73422->73362 73423->73362 73424 7ff71abed5f0 73425 7ff71abed608 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock _aligned_msize type_info::_name_internal_method shared_ptr 73424->73425 73430 7ff71abefba0 73425->73430 73429 7ff71abed659 73435 7ff71abfafb0 73430->73435 73454 7ff71abfb130 73430->73454 73431 7ff71abed654 73434 7ff71ade1a54 60 API calls std::_Throw_Cpp_error 73431->73434 73434->73429 73436 7ff71abf11a0 _Mpunct 51 API calls 73435->73436 73437 7ff71abfafda 73436->73437 73438 7ff71ac398a0 71 API calls 73437->73438 73439 7ff71abfafee shared_ptr 73438->73439 73440 7ff71abf11a0 _Mpunct 51 API calls 73439->73440 73441 7ff71abfb014 UnDecorator::getVbTableType 73440->73441 73442 7ff71abf10b0 51 API calls 73441->73442 73443 7ff71abfb03c shared_ptr 73442->73443 73444 7ff71abfb05f OpenEventW 73443->73444 73445 7ff71abfb07e UnDecorator::getVbTableType 73444->73445 73529 7ff71adbf160 73445->73529 73746 7ff71adc0140 73445->73746 73449 7ff71abfb0a8 73450 7ff71abfb0b0 CloseHandle 73449->73450 73451 7ff71abfb0bc 73449->73451 73450->73451 73452 7ff71abf3c10 shared_ptr 47 API calls 73451->73452 73453 7ff71abfb0c6 73452->73453 73453->73431 73455 7ff71abf11a0 _Mpunct 51 API calls 73454->73455 73456 7ff71abfb161 73455->73456 73457 7ff71ac398a0 71 API calls 73456->73457 73458 7ff71abfb17b 73457->73458 73459 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73458->73459 73460 7ff71abfb1e0 73459->73460 73461 7ff71ac38e90 71 API calls 73460->73461 73462 7ff71abfb1fd shared_ptr UnDecorator::getVbTableType 73461->73462 73463 7ff71abfb227 RegisterClassExW 73462->73463 73464 7ff71abfb24d 73463->73464 73472 7ff71abfb23d UnDecorator::getVbTableType 73463->73472 73465 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73464->73465 73466 7ff71abfb283 73465->73466 73467 7ff71ac38e90 71 API calls 73466->73467 73468 7ff71abfb2a0 shared_ptr 73467->73468 73469 7ff71abfb2b5 CreateWindowExW 73468->73469 73470 7ff71abfb33a UnDecorator::getVbTableType 73469->73470 73471 7ff71abfb35a ShowWindow 73470->73471 73470->73472 73473 7ff71abfb384 73471->73473 73472->73431 73474 7ff71ac0c710 51 API calls 73473->73474 73475 7ff71abfb3bb 73474->73475 73476 7ff71ac0c1b0 51 API calls 73475->73476 73477 7ff71abfb3cd 73476->73477 73478 7ff71abf11a0 _Mpunct 51 API calls 73477->73478 73479 7ff71abfb40b 73478->73479 73480 7ff71ac398a0 71 API calls 73479->73480 73481 7ff71abfb428 73480->73481 73482 7ff71abf11a0 _Mpunct 51 API calls 73481->73482 73483 7ff71abfb44d 73482->73483 73484 7ff71ac398a0 71 API calls 73483->73484 73485 7ff71abfb46a 73484->73485 73486 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73485->73486 73487 7ff71abfb490 73486->73487 73488 7ff71ac38e90 71 API calls 73487->73488 73489 7ff71abfb4ad 73488->73489 73490 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73489->73490 73491 7ff71abfb4fa 73490->73491 73492 7ff71ac38e90 71 API calls 73491->73492 73493 7ff71abfb517 73492->73493 75048 7ff71abf5950 73493->75048 73495 7ff71abfb54b 75057 7ff71abf5880 73495->75057 73497 7ff71abfb590 shared_ptr UnDecorator::getVbTableType 73498 7ff71abf50c0 task 51 API calls 73497->73498 73502 7ff71abfbfd8 UnDecorator::getVbTableType 73497->73502 73508 7ff71abf11a0 51 API calls _Mpunct 73497->73508 73511 7ff71abfbe5e OpenEventW 73497->73511 73513 7ff71abfbe49 73497->73513 73517 7ff71ac398a0 71 API calls 73497->73517 73518 7ff71abf0510 67 API calls 73497->73518 73524 7ff71ac38e90 71 API calls 73497->73524 73525 7ff71abf0450 49 API calls Concurrency::details::SchedulerBase::GetPolicy 73497->73525 73526 7ff71ac7d350 89 API calls 73497->73526 73527 7ff71ac0d500 75 API calls 73497->73527 73528 7ff71ac03b30 107 API calls 73497->73528 75066 7ff71ac75130 keybd_event keybd_event 73497->75066 75067 7ff71ac5ab70 189 API calls 2 library calls 73497->75067 73499 7ff71abfb5e7 GetForegroundWindow 73498->73499 73501 7ff71abfb62f Concurrency::details::WorkQueue::IsStructuredEmpty 73499->73501 73500 7ff71abfb602 GetWindowTextW 73500->73501 73501->73500 73503 7ff71abfb662 PeekMessageW 73501->73503 73506 7ff71abf3c10 shared_ptr 47 API calls 73502->73506 73504 7ff71abfb692 TranslateMessage DispatchMessageW 73503->73504 73505 7ff71abfbe21 SleepEx 73503->73505 73504->73497 73505->73497 73507 7ff71abfc021 73506->73507 73509 7ff71abf3c10 shared_ptr 47 API calls 73507->73509 73508->73497 73509->73472 73511->73497 73512 7ff71abfbe82 WaitForSingleObject 73511->73512 73512->73497 73520 7ff71abfbe9a shared_ptr UnDecorator::getVbTableType 73512->73520 73513->73497 73515 7ff71abf11a0 51 API calls _Mpunct 73515->73520 73516 7ff71ac398a0 71 API calls 73516->73520 73517->73497 73518->73497 73519 7ff71abf10b0 51 API calls 73519->73520 73520->73515 73520->73516 73520->73519 73521 7ff71ac8db90 81 API calls 73520->73521 73522 7ff71abfbfb8 CloseHandle 73521->73522 73523 7ff71abf3c10 shared_ptr 47 API calls 73522->73523 73523->73513 73524->73497 73525->73497 73526->73497 73527->73497 73528->73497 73530 7ff71abf0f30 _Mpunct 51 API calls 73529->73530 73531 7ff71adbf18e 73530->73531 73963 7ff71ac39aa0 73531->73963 73534 7ff71abf0f30 _Mpunct 51 API calls 73535 7ff71adbf1d0 73534->73535 73536 7ff71ac39aa0 59 API calls 73535->73536 73537 7ff71adbf1ed 73536->73537 73538 7ff71abf0f30 _Mpunct 51 API calls 73537->73538 73539 7ff71adbf212 73538->73539 73540 7ff71ac39aa0 59 API calls 73539->73540 73541 7ff71adbf22f 73540->73541 73542 7ff71abf0f30 _Mpunct 51 API calls 73541->73542 73543 7ff71adbf254 73542->73543 73544 7ff71ac39aa0 59 API calls 73543->73544 73545 7ff71adbf271 73544->73545 73546 7ff71abf0f30 _Mpunct 51 API calls 73545->73546 73547 7ff71adbf296 73546->73547 73548 7ff71ac39aa0 59 API calls 73547->73548 73549 7ff71adbf2b3 73548->73549 73993 7ff71abf0e90 73549->73993 73560 7ff71ac19140 shared_ptr 47 API calls 73561 7ff71adbf39b 73560->73561 73562 7ff71ac19140 shared_ptr 47 API calls 73561->73562 73563 7ff71adbf3a9 73562->73563 73564 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73563->73564 73565 7ff71adbf3b7 73564->73565 74048 7ff71adc7830 73565->74048 73568 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73569 7ff71adbf3fe 73568->73569 73570 7ff71ac39580 54 API calls 73569->73570 73571 7ff71adbf41b 73570->73571 73572 7ff71ac7f8f0 54 API calls 73571->73572 73573 7ff71adbf44b 73572->73573 73574 7ff71ac788f0 51 API calls 73573->73574 73575 7ff71adbf469 73574->73575 74086 7ff71ac6bf80 73575->74086 73747 7ff71abf0f30 _Mpunct 51 API calls 73746->73747 73748 7ff71adc016e 73747->73748 73749 7ff71ac39aa0 59 API calls 73748->73749 73750 7ff71adc018b 73749->73750 73751 7ff71abf0f30 _Mpunct 51 API calls 73750->73751 73752 7ff71adc01b0 73751->73752 73753 7ff71ac39aa0 59 API calls 73752->73753 73754 7ff71adc01cd 73753->73754 73755 7ff71abf0f30 _Mpunct 51 API calls 73754->73755 73756 7ff71adc01f2 73755->73756 73757 7ff71ac39aa0 59 API calls 73756->73757 73758 7ff71adc020f 73757->73758 73759 7ff71abf0f30 _Mpunct 51 API calls 73758->73759 73760 7ff71adc0234 73759->73760 73761 7ff71ac39aa0 59 API calls 73760->73761 73762 7ff71adc0251 73761->73762 73763 7ff71abf0f30 _Mpunct 51 API calls 73762->73763 73764 7ff71adc0276 73763->73764 73765 7ff71ac39aa0 59 API calls 73764->73765 73766 7ff71adc0293 73765->73766 73767 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73766->73767 73768 7ff71adc02b9 73767->73768 73769 7ff71ac39580 54 API calls 73768->73769 73770 7ff71adc02d6 73769->73770 73771 7ff71ac7f8f0 54 API calls 73770->73771 73772 7ff71adc0306 73771->73772 73773 7ff71adbcaf0 52 API calls 73772->73773 73774 7ff71adc0338 73773->73774 73775 7ff71ac788f0 51 API calls 73774->73775 73776 7ff71adc036d 73775->73776 73777 7ff71ac19140 shared_ptr 47 API calls 73776->73777 73778 7ff71adc037b 73777->73778 73779 7ff71ac19140 shared_ptr 47 API calls 73778->73779 73780 7ff71adc0389 73779->73780 73781 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73780->73781 73782 7ff71adc0397 73781->73782 73783 7ff71adc7830 99 API calls 73782->73783 73784 7ff71adc03b8 73783->73784 73785 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73784->73785 73786 7ff71adc03de 73785->73786 73787 7ff71ac39580 54 API calls 73786->73787 73788 7ff71adc03fb 73787->73788 73789 7ff71ac7f8f0 54 API calls 73788->73789 73790 7ff71adc042b 73789->73790 73791 7ff71ac788f0 51 API calls 73790->73791 73792 7ff71adc0449 73791->73792 73793 7ff71ac6bf80 75 API calls 73792->73793 73794 7ff71adc046e 73793->73794 73795 7ff71ac19140 shared_ptr 47 API calls 73794->73795 73796 7ff71adc047f 73795->73796 73797 7ff71ac19140 shared_ptr 47 API calls 73796->73797 73798 7ff71adc048d 73797->73798 73799 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73798->73799 73800 7ff71adc049b 73799->73800 73801 7ff71adc058f 73800->73801 73802 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73800->73802 73803 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73801->73803 73804 7ff71adc04cd 73802->73804 73805 7ff71adc05b5 73803->73805 73806 7ff71ac39580 54 API calls 73804->73806 73807 7ff71ac39580 54 API calls 73805->73807 73808 7ff71adc04ea 73806->73808 73809 7ff71adc05d2 73807->73809 73811 7ff71ac7f8f0 54 API calls 73808->73811 73810 7ff71ac7f8f0 54 API calls 73809->73810 73813 7ff71adc0602 73810->73813 73812 7ff71adc051a 73811->73812 73814 7ff71ac788f0 51 API calls 73812->73814 73815 7ff71ac788f0 51 API calls 73813->73815 73816 7ff71adc0538 73814->73816 73817 7ff71adc0620 73815->73817 75039 7ff71adc7d20 51 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 73816->75039 73819 7ff71ac6bf80 75 API calls 73817->73819 73821 7ff71adc0645 73819->73821 73820 7ff71adc0565 73822 7ff71ac19140 shared_ptr 47 API calls 73820->73822 73823 7ff71ac19140 shared_ptr 47 API calls 73821->73823 73824 7ff71adc0573 73822->73824 73825 7ff71adc0656 73823->73825 73826 7ff71ac19140 shared_ptr 47 API calls 73824->73826 73827 7ff71ac19140 shared_ptr 47 API calls 73825->73827 73828 7ff71adc0581 73826->73828 73829 7ff71adc0664 73827->73829 73830 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73828->73830 73831 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73829->73831 73830->73801 73832 7ff71adc0672 73831->73832 73833 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73832->73833 73839 7ff71adc0766 HandleT Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 73832->73839 73834 7ff71adc06a4 73833->73834 73835 7ff71ac39580 54 API calls 73834->73835 73836 7ff71adc06c1 73835->73836 73837 7ff71ac7f8f0 54 API calls 73836->73837 73838 7ff71adc06f1 73837->73838 73841 7ff71ac788f0 51 API calls 73838->73841 73840 7ff71adc0a6d 73839->73840 73842 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73839->73842 73847 7ff71abf11a0 _Mpunct 51 API calls 73840->73847 73962 7ff71adc104d UnDecorator::getVbTableType 73840->73962 73843 7ff71adc070f 73841->73843 73844 7ff71adc07e7 73842->73844 75040 7ff71adc7d20 51 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 73843->75040 73846 7ff71ac39580 54 API calls 73844->73846 73849 7ff71adc0804 73846->73849 73851 7ff71adc0aac 73847->73851 73848 7ff71adc073c 73852 7ff71ac19140 shared_ptr 47 API calls 73848->73852 73853 7ff71ac7f8f0 54 API calls 73849->73853 73850 7ff71adbc450 47 API calls 73854 7ff71adc10a9 73850->73854 73856 7ff71ac398a0 71 API calls 73851->73856 73857 7ff71adc074a 73852->73857 73858 7ff71adc0834 73853->73858 73855 7ff71adbc430 47 API calls 73854->73855 73859 7ff71adc10b4 73855->73859 73860 7ff71adc0ac9 73856->73860 73861 7ff71ac19140 shared_ptr 47 API calls 73857->73861 73862 7ff71ac788f0 51 API calls 73858->73862 73863 7ff71ac19140 shared_ptr 47 API calls 73859->73863 73864 7ff71abf11a0 _Mpunct 51 API calls 73860->73864 73865 7ff71adc0758 73861->73865 73866 7ff71adc084f 73862->73866 73867 7ff71adc10c2 73863->73867 73868 7ff71adc0aee 73864->73868 73869 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73865->73869 73870 7ff71ac6bf80 75 API calls 73866->73870 73871 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73867->73871 73872 7ff71ac398a0 71 API calls 73868->73872 73869->73839 73873 7ff71adc0874 73870->73873 73874 7ff71adc10d0 73871->73874 73875 7ff71adc0b0b 73872->73875 73876 7ff71ac19140 shared_ptr 47 API calls 73873->73876 73877 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73874->73877 73878 7ff71abf11a0 _Mpunct 51 API calls 73875->73878 73879 7ff71adc0885 73876->73879 73881 7ff71adc10de 73877->73881 73882 7ff71adc0b30 73878->73882 73880 7ff71ac19140 shared_ptr 47 API calls 73879->73880 73883 7ff71adc0893 73880->73883 73884 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73881->73884 73885 7ff71ac398a0 71 API calls 73882->73885 73887 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73883->73887 73888 7ff71adc10ec 73884->73888 73886 7ff71adc0b4d 73885->73886 73889 7ff71abf11a0 _Mpunct 51 API calls 73886->73889 73890 7ff71adc08a1 73887->73890 73891 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73888->73891 73892 7ff71adc0b72 73889->73892 73890->73840 73895 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 73890->73895 73893 7ff71adc10fa 73891->73893 73894 7ff71ac398a0 71 API calls 73892->73894 73896 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73893->73896 73900 7ff71adc0b8f 73894->73900 73897 7ff71adc08d3 73895->73897 73898 7ff71abfb089 WaitForSingleObject 73896->73898 73899 7ff71ac39580 54 API calls 73897->73899 73898->73445 73898->73449 73901 7ff71adc08f0 73899->73901 75042 7ff71adbb4e0 47 API calls 73900->75042 73902 7ff71ac7f8f0 54 API calls 73901->73902 73903 7ff71adc0920 73902->73903 73905 7ff71ac788f0 51 API calls 73903->73905 73906 7ff71adc093b 73905->73906 73907 7ff71adc7270 120 API calls 73906->73907 73908 7ff71adc0968 73907->73908 73909 7ff71ac19140 shared_ptr 47 API calls 73908->73909 73910 7ff71adc0976 73909->73910 73911 7ff71ac19140 shared_ptr 47 API calls 73910->73911 73913 7ff71adc0984 73911->73913 73912 7ff71adc0bdf 75043 7ff71adbb760 47 API calls 73912->75043 73915 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73913->73915 73919 7ff71adc0992 73915->73919 73916 7ff71adc0c42 75044 7ff71adc7e90 51 API calls 73916->75044 73918 7ff71adc0c96 73920 7ff71abf05d0 59 API calls 73918->73920 75041 7ff71adbb360 51 API calls 2 library calls 73919->75041 73922 7ff71adc0ca1 73920->73922 73924 7ff71abf11a0 _Mpunct 51 API calls 73922->73924 73923 7ff71adc0a5f 73925 7ff71adbc430 47 API calls 73923->73925 73926 7ff71adc0cc6 73924->73926 73925->73840 73927 7ff71ac398a0 71 API calls 73926->73927 73928 7ff71adc0ce0 73927->73928 75045 7ff71adb5480 51 API calls 2 library calls 73928->75045 73930 7ff71adc0cf3 75046 7ff71ac1c650 51 API calls 3 library calls 73930->75046 73932 7ff71adc0d1f Concurrency::details::WorkQueue::IsStructuredEmpty 73933 7ff71abf04b0 69 API calls 73932->73933 73934 7ff71adc0d54 73933->73934 73935 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73934->73935 73936 7ff71adc0da1 73935->73936 73937 7ff71ac38e90 71 API calls 73936->73937 73938 7ff71adc0dbe shared_ptr 73937->73938 73939 7ff71abfa250 69 API calls 73938->73939 73940 7ff71adc0e05 UnDecorator::getVbTableType 73939->73940 73941 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73940->73941 73942 7ff71adc0e2f 73941->73942 73943 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73942->73943 73944 7ff71adc0e55 73943->73944 73945 7ff71ac38e90 71 API calls 73944->73945 73946 7ff71adc0e72 73945->73946 73947 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73946->73947 73948 7ff71adc0ebf 73947->73948 73949 7ff71ac38e90 71 API calls 73948->73949 73950 7ff71adc0edc 73949->73950 73951 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73950->73951 73952 7ff71adc0f29 73951->73952 73953 7ff71ac38e90 71 API calls 73952->73953 73954 7ff71adc0f46 73953->73954 73955 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 73954->73955 73956 7ff71adc0f93 73955->73956 73957 7ff71ac38e90 71 API calls 73956->73957 73958 7ff71adc0fb0 73957->73958 73959 7ff71ac7ca30 76 API calls 73958->73959 73960 7ff71adc1007 UnDecorator::getVbTableType 73959->73960 75047 7ff71ac191f0 51 API calls task 73960->75047 73962->73850 73964 7ff71abf11a0 _Mpunct 51 API calls 73963->73964 73965 7ff71ac39acd 73964->73965 73966 7ff71ac38170 51 API calls 73965->73966 73967 7ff71ac39ae0 73966->73967 73968 7ff71ac385c0 type_info::_name_internal_method 51 API calls 73967->73968 73969 7ff71ac39af6 73968->73969 74193 7ff71ac2cad0 73969->74193 73972 7ff71ac39e60 51 API calls 73973 7ff71ac39b35 73972->73973 73974 7ff71ac38140 type_info::_name_internal_method 51 API calls 73973->73974 73975 7ff71ac39b56 73974->73975 73976 7ff71abf3c10 shared_ptr 47 API calls 73975->73976 73977 7ff71ac39b64 73976->73977 73978 7ff71abf3c10 shared_ptr 47 API calls 73977->73978 73979 7ff71ac39b72 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 73978->73979 73980 7ff71ac389d0 51 API calls 73979->73980 73984 7ff71ac39bad shared_ptr 73980->73984 73981 7ff71ac39c64 std::_Throw_Cpp_error 73983 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73981->73983 73985 7ff71ac39c91 73983->73985 73984->73981 74202 7ff71ac38200 47 API calls 73984->74202 74203 7ff71ac39cd0 51 API calls 2 library calls 73984->74203 73987 7ff71abf3c10 shared_ptr 47 API calls 73985->73987 73988 7ff71ac39c9f 73987->73988 73989 7ff71abf3c10 shared_ptr 47 API calls 73988->73989 73990 7ff71ac39cad 73989->73990 73991 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 73990->73991 73992 7ff71ac39cbb 73991->73992 73992->73534 73994 7ff71abf0eb2 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::cancellation_token::_FromImpl _aligned_msize 73993->73994 74260 7ff71abeb760 73994->74260 73996 7ff71abf0f16 73997 7ff71ac39580 73996->73997 74001 7ff71ac395ab shared_ptr 73997->74001 73998 7ff71ac38610 54 API calls 73999 7ff71ac39659 73998->73999 74000 7ff71ac3966a 73999->74000 74005 7ff71ac396a7 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 73999->74005 74002 7ff71ac37fa0 47 API calls 74000->74002 74001->73998 74003 7ff71ac3968c 74002->74003 74004 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 74003->74004 74006 7ff71ac3969a 74004->74006 74267 7ff71abe97a0 51 API calls 4 library calls 74005->74267 74022 7ff71ac7f8f0 74006->74022 74008 7ff71ac3973d Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 74268 7ff71abe97a0 51 API calls 4 library calls 74008->74268 74010 7ff71ac397f2 74011 7ff71ac39e60 51 API calls 74010->74011 74012 7ff71ac39810 74011->74012 74013 7ff71abf3c10 shared_ptr 47 API calls 74012->74013 74014 7ff71ac39855 74013->74014 74015 7ff71abf3c10 shared_ptr 47 API calls 74014->74015 74016 7ff71ac39863 74015->74016 74017 7ff71abf3c10 shared_ptr 47 API calls 74016->74017 74018 7ff71ac39871 74017->74018 74019 7ff71ac37fa0 47 API calls 74018->74019 74020 7ff71ac3987c 74019->74020 74021 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 74020->74021 74021->74006 74269 7ff71ac7ff10 74022->74269 74025 7ff71adbcaf0 74026 7ff71adbcb23 74025->74026 74027 7ff71adbcb54 74026->74027 74028 7ff71adbcb2e 74026->74028 74305 7ff71ac3e140 51 API calls 74027->74305 74304 7ff71adb5250 51 API calls 74028->74304 74031 7ff71adbcb66 CoTaskMemFree 74033 7ff71adbcb80 74031->74033 74032 7ff71adbcb42 74035 7ff71ac788f0 74032->74035 74034 7ff71ac19140 shared_ptr 47 API calls 74033->74034 74034->74032 74040 7ff71ac78920 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 74035->74040 74036 7ff71ac78afb 74307 7ff71ac17620 74036->74307 74040->74036 74044 7ff71ac78992 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= std::_Is_slash_oper::operator 74040->74044 74041 7ff71ac78b26 74042 7ff71ac19140 shared_ptr 47 API calls 74041->74042 74043 7ff71ac78af1 74042->74043 74043->73560 74306 7ff71ac77ee0 51 API calls 2 library calls 74044->74306 74046 7ff71ac78ac9 74047 7ff71ac19140 shared_ptr 47 API calls 74046->74047 74047->74043 74049 7ff71adc7856 74048->74049 74050 7ff71ac6bf80 75 API calls 74049->74050 74051 7ff71adc7864 74050->74051 74053 7ff71adc7bc6 74051->74053 74333 7ff71adc7140 74051->74333 74055 7ff71adbc450 47 API calls 74053->74055 74056 7ff71adbf3d8 74055->74056 74056->73568 74087 7ff71ac6bf93 74086->74087 74204 7ff71ac25230 74193->74204 74195 7ff71ac2caf3 74211 7ff71ac2ab10 74195->74211 74197 7ff71ac2cb0b 74198 7ff71abf3c10 shared_ptr 47 API calls 74197->74198 74199 7ff71ac2cb32 74198->74199 74215 7ff71ac258f0 74199->74215 74201 7ff71ac2cb3d 74201->73972 74202->73984 74203->73984 74205 7ff71abf3410 std::ios_base::_Init 59 API calls 74204->74205 74206 7ff71ac25259 74205->74206 74207 7ff71ae02bd0 std::ios_base::_Init 4 API calls 74206->74207 74208 7ff71ac252a3 74207->74208 74210 7ff71ac252bc 74208->74210 74220 7ff71ac24f30 58 API calls std::bad_exception::bad_exception 74208->74220 74210->74195 74212 7ff71ac2ab35 Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 74211->74212 74221 7ff71ac2ab80 74212->74221 74216 7ff71abf3c10 shared_ptr 47 API calls 74215->74216 74217 7ff71ac25919 74216->74217 74218 7ff71abf3be0 Concurrency::details::HardwareAffinity::operator!= 47 API calls 74217->74218 74219 7ff71ac2592a type_info::_name_internal_method 74218->74219 74219->74201 74220->74210 74222 7ff71ac2abae 74221->74222 74223 7ff71ac02e10 51 API calls 74222->74223 74229 7ff71ac2ac11 Concurrency::details::HardwareAffinity::operator!= 74223->74229 74224 7ff71ac2ad5c 74225 7ff71abf3c10 shared_ptr 47 API calls 74224->74225 74226 7ff71ac2aed8 74225->74226 74227 7ff71abf3c10 shared_ptr 47 API calls 74226->74227 74255 7ff71ac2ab66 74227->74255 74228 7ff71ac2ad28 74231 7ff71ac2ad62 Concurrency::details::HardwareAffinity::operator!= 74228->74231 74232 7ff71ac2ad34 74228->74232 74229->74224 74229->74228 74230 7ff71ac2ad18 74229->74230 74233 7ff71ac2adf7 74230->74233 74234 7ff71ac2ad23 74230->74234 74236 7ff71ac2ad87 74231->74236 74237 7ff71ac2ad72 74231->74237 74235 7ff71ac02d10 type_info::_name_internal_method 51 API calls 74232->74235 74233->74224 74258 7ff71ac2b9d0 51 API calls 2 library calls 74233->74258 74238 7ff71ac2ae99 74234->74238 74239 7ff71ac2ae4e 74234->74239 74235->74224 74243 7ff71ac2ad97 74236->74243 74244 7ff71ac2ade5 74236->74244 74241 7ff71ac02e10 51 API calls 74237->74241 74259 7ff71ac27f30 51 API calls 2 library calls 74238->74259 74245 7ff71abf10b0 51 API calls 74239->74245 74241->74224 74246 7ff71abf10b0 51 API calls 74243->74246 74257 7ff71ac27f30 51 API calls 2 library calls 74244->74257 74247 7ff71ac2ae6a 74245->74247 74249 7ff71ac2adb3 74246->74249 74250 7ff71abf3c10 shared_ptr 47 API calls 74247->74250 74251 7ff71abf3c10 shared_ptr 47 API calls 74249->74251 74252 7ff71ac2ae82 74250->74252 74253 7ff71ac2adcb 74251->74253 74254 7ff71abf3c10 shared_ptr 47 API calls 74252->74254 74256 7ff71abf3c10 shared_ptr 47 API calls 74253->74256 74254->74255 74255->74197 74256->74255 74257->74224 74258->74233 74259->74224 74261 7ff71abeb787 Concurrency::task_continuation_context::task_continuation_context 74260->74261 74264 7ff71abeb796 Concurrency::details::WorkQueue::IsStructuredEmpty std::_Throw_Cpp_error _Mpunct Concurrency::task_continuation_context::task_continuation_context 74261->74264 74266 7ff71ac02970 51 API calls Concurrency::task_continuation_context::task_continuation_context 74261->74266 74263 7ff71abeb7d2 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock task type_info::_name_internal_method 74263->73996 74264->74263 74265 7ff71abeaf90 Concurrency::task_continuation_context::task_continuation_context 49 API calls 74264->74265 74265->74263 74266->74264 74267->74008 74268->74010 74270 7ff71ac7ff3c 74269->74270 74273 7ff71ac77cb0 74270->74273 74278 7ff71ade7358 74273->74278 74279 7ff71ae1ab18 _Getctype 47 API calls 74278->74279 74280 7ff71ade7361 74279->74280 74281 7ff71ac77ce6 74280->74281 74282 7ff71ade736a AreFileApisANSI 74280->74282 74283 7ff71ac79a70 74281->74283 74282->74281 74287 7ff71ac79a97 std::error_category::equivalent List 74283->74287 74284 7ff71ac79ba8 74285 7ff71abf3c10 shared_ptr 47 API calls 74284->74285 74286 7ff71ac77d14 74285->74286 74286->74025 74287->74284 74289 7ff71ac79ad6 std::error_category::equivalent shared_ptr 74287->74289 74299 7ff71ac64c30 51 API calls 2 library calls 74287->74299 74300 7ff71ade7380 MultiByteToWideChar GetLastError 74289->74300 74291 7ff71ac79b1b 74301 7ff71ac5f420 51 API calls 74291->74301 74293 7ff71ac79b2a 74294 7ff71ac0c710 51 API calls 74293->74294 74295 7ff71ac79b43 Concurrency::details::WorkQueue::IsStructuredEmpty std::error_category::equivalent shared_ptr 74294->74295 74302 7ff71ade7380 MultiByteToWideChar GetLastError 74295->74302 74297 7ff71ac79b99 74303 7ff71ac5f420 51 API calls 74297->74303 74299->74289 74300->74291 74301->74293 74302->74297 74303->74284 74304->74032 74305->74031 74306->74046 74308 7ff71abf10b0 51 API calls 74307->74308 74309 7ff71ac1764a 74308->74309 74310 7ff71ac78cd0 74309->74310 74311 7ff71ac78ceb 74310->74311 74312 7ff71ac78cf2 74311->74312 74315 7ff71ac78d0c Concurrency::details::WorkQueue::IsStructuredEmpty Concurrency::details::HardwareAffinity::operator!= 74311->74315 74328 7ff71ac78640 51 API calls task 74312->74328 74314 7ff71ac78d07 74314->74041 74316 7ff71ac78ddd std::_Is_slash_oper::operator 74315->74316 74320 7ff71ac78dc3 74315->74320 74317 7ff71ac78e37 74316->74317 74323 7ff71ac78e04 74316->74323 74318 7ff71ac78e43 74317->74318 74324 7ff71ac78e7a std::_Is_slash_oper::operator 74317->74324 74319 7ff71ac78e31 74318->74319 74331 7ff71ac2b9d0 51 API calls 2 library calls 74318->74331 74325 7ff71ac02d10 type_info::_name_internal_method 51 API calls 74319->74325 74329 7ff71ac78640 51 API calls task 74320->74329 74330 7ff71ac7a370 51 API calls type_info::_name_internal_method 74323->74330 74324->74319 74332 7ff71ac2b9d0 51 API calls 2 library calls 74324->74332 74325->74314 74328->74314 74329->74314 74330->74319 74331->74319 74332->74319 74346 7ff71adc7ff0 74333->74346 74335 7ff71adc7158 74351 7ff71ac61930 74346->74351 74348 7ff71adc8015 74349 7ff71adc804d 74348->74349 74355 7ff71ac84810 56 API calls 4 library calls 74348->74355 74349->74335 74352 7ff71ac6194f Concurrency::details::WorkQueue::IsStructuredEmpty 74351->74352 74356 7ff71ade76a8 74352->74356 74354 7ff71ac61977 74354->74348 74355->74349 74358 7ff71ade76ea 74356->74358 74357 7ff71ade76f3 74360 7ff71ae031a0 std::_Throw_Cpp_error 8 API calls 74357->74360 74358->74357 74359 7ff71ade7805 74358->74359 74362 7ff71ade774b GetFileAttributesExW 74358->74362 74399 7ff71ade79d8 CreateFileW GetLastError 74359->74399 74363 7ff71ade798b 74360->74363 74365 7ff71ade77b0 74362->74365 74366 7ff71ade775f GetLastError 74362->74366 74363->74354 74364 7ff71ade7828 74367 7ff71ade784e 74364->74367 74368 7ff71ade782e 74364->74368 74365->74357 74365->74359 74366->74357 74369 7ff71ade776e FindFirstFileW 74366->74369 74371 7ff71ade78fb 74367->74371 74372 7ff71ade785d GetFileInformationByHandleEx 74367->74372 74370 7ff71ade7839 CloseHandle 74368->74370 74391 7ff71ade7847 74368->74391 74373 7ff71ade7782 GetLastError 74369->74373 74374 7ff71ade778d FindClose 74369->74374 74375 7ff71ade79bd 74370->74375 74370->74391 74376 7ff71ade7950 74371->74376 74377 7ff71ade7916 GetFileInformationByHandleEx 74371->74377 74378 7ff71ade789d 74372->74378 74379 7ff71ade7877 GetLastError 74372->74379 74373->74357 74374->74365 74400 7ff71ae0fd98 47 API calls __std_fs_directory_iterator_open 74375->74400 74383 7ff71ade79a3 74376->74383 74384 7ff71ade7967 74376->74384 74377->74376 74381 7ff71ade792c GetLastError 74377->74381 74378->74371 74390 7ff71ade78be GetFileInformationByHandleEx 74378->74390 74382 7ff71ade7885 CloseHandle 74379->74382 74379->74391 74381->74391 74382->74391 74383->74391 74384->74357 74390->74371 74391->74357 74399->74364 75039->73820 75040->73848 75041->73923 75042->73912 75043->73916 75044->73918 75045->73930 75046->73932 75047->73962 75049 7ff71abfa780 57 API calls 75048->75049 75050 7ff71abf5975 75049->75050 75068 7ff71abf0480 75050->75068 75052 7ff71abf5982 std::ios_base::good shared_ptr UnDecorator::getVbTableType 75071 7ff71abf85e0 75052->75071 75055 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75056 7ff71abf59de UnDecorator::getVbTableType 75055->75056 75056->73495 75058 7ff71abfa780 57 API calls 75057->75058 75059 7ff71abf58a5 75058->75059 75060 7ff71abf0480 2 API calls 75059->75060 75061 7ff71abf58b2 std::ios_base::good shared_ptr 75060->75061 75062 7ff71abf85e0 50 API calls 75061->75062 75063 7ff71abf5914 75062->75063 75064 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75063->75064 75065 7ff71abf5923 UnDecorator::getVbTableType 75064->75065 75065->73497 75066->73513 75067->73497 75069 7ff71abf03d0 2 API calls 75068->75069 75070 7ff71abf049d 75069->75070 75070->75052 75072 7ff71abfa510 strrchr 50 API calls 75071->75072 75073 7ff71abf8616 75072->75073 75074 7ff71ac10d40 UnDecorator::getVbTableType 47 API calls 75073->75074 75075 7ff71abf8640 75074->75075 75076 7ff71ac10d40 UnDecorator::getVbTableType 47 API calls 75075->75076 75077 7ff71abf867b 75076->75077 75078 7ff71abfae00 UnDecorator::getVbTableType 2 API calls 75077->75078 75079 7ff71abf59cf 75078->75079 75079->75055 75080 7ff71abf16d0 75081 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75080->75081 75082 7ff71abf1718 75081->75082 75083 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75082->75083 75084 7ff71abf1742 75083->75084 75085 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75084->75085 75086 7ff71abf176c 75085->75086 75087 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75086->75087 75088 7ff71abf17a8 75087->75088 75089 7ff71abf11a0 _Mpunct 51 API calls 75088->75089 75090 7ff71abf1942 75089->75090 75091 7ff71abf05d0 59 API calls 75090->75091 75092 7ff71abf1970 75091->75092 75217 7ff71ad9e070 75092->75217 75094 7ff71abf199c 75225 7ff71ac21780 75094->75225 75096 7ff71abf19ca 75231 7ff71ac8f5c0 75096->75231 75100 7ff71abf19f7 75241 7ff71adb4db0 75100->75241 75102 7ff71abf1a4a 75103 7ff71abf11a0 _Mpunct 51 API calls 75102->75103 75104 7ff71abf1b83 75103->75104 75105 7ff71ac398a0 71 API calls 75104->75105 75106 7ff71abf1ba0 shared_ptr 75105->75106 75107 7ff71abf11a0 _Mpunct 51 API calls 75106->75107 75108 7ff71abf1bd5 UnDecorator::getVbTableType 75107->75108 75109 7ff71abf10b0 51 API calls 75108->75109 75110 7ff71abf1c09 shared_ptr 75109->75110 75111 7ff71abf1c3b CreateEventW 75110->75111 75112 7ff71abf1c67 UnDecorator::getVbTableType 75111->75112 75244 7ff71abf97a0 GetDesktopWindow EnumChildWindows 75112->75244 75114 7ff71abf1c75 75115 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75114->75115 75116 7ff71abf1c80 75115->75116 75117 7ff71abf1c9f 75116->75117 75357 7ff71ac8c0b0 74 API calls 4 library calls 75116->75357 75119 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75117->75119 75120 7ff71abf1cda 75119->75120 75121 7ff71abf1cf3 75120->75121 75358 7ff71ac940f0 49 API calls 75120->75358 75245 7ff71ac8e000 75121->75245 75125 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75126 7ff71abf1d43 75125->75126 75127 7ff71abf1d62 75126->75127 75252 7ff71ac90320 75126->75252 75129 7ff71adb3e60 50 API calls 75127->75129 75130 7ff71abf1da4 75129->75130 75255 7ff71ac04410 75130->75255 75132 7ff71abf1db1 75133 7ff71abf5950 60 API calls 75132->75133 75134 7ff71abf1dd5 shared_ptr 75133->75134 75135 7ff71abf1dea CreateDirectoryW 75134->75135 75136 7ff71abf1e02 UnDecorator::getVbTableType 75135->75136 75137 7ff71abf11a0 _Mpunct 51 API calls 75136->75137 75138 7ff71abf1e27 75137->75138 75139 7ff71ac398a0 71 API calls 75138->75139 75140 7ff71abf1e44 shared_ptr 75139->75140 75141 7ff71abf11a0 _Mpunct 51 API calls 75140->75141 75142 7ff71abf1e79 UnDecorator::getVbTableType 75141->75142 75143 7ff71abf10b0 51 API calls 75142->75143 75144 7ff71abf1ead shared_ptr 75143->75144 75145 7ff71abf1edf CreateEventW 75144->75145 75146 7ff71abf1f0b UnDecorator::getVbTableType 75145->75146 75272 7ff71ac04620 75146->75272 75218 7ff71ad9e0a5 75217->75218 75219 7ff71ad9e0db CoInitializeEx 75218->75219 75220 7ff71ad9e0f3 75219->75220 75224 7ff71ad9e0f1 75219->75224 75374 7ff71ac59be0 CoCreateInstance 75220->75374 75222 7ff71ad9e11b 75222->75224 75375 7ff71ad9e460 75222->75375 75224->75094 75226 7ff71ac217b3 75225->75226 75227 7ff71abf0510 67 API calls 75226->75227 75228 7ff71ac217c5 75227->75228 75451 7ff71ac21a20 75228->75451 75230 7ff71ac217d7 UnDecorator::getVbTableType 75230->75096 75460 7ff71adcaf60 75231->75460 75233 7ff71ac8f5d6 75465 7ff71ac8f480 75233->75465 75236 7ff71ac99690 75493 7ff71ac25030 75236->75493 75239 7ff71ac25030 49 API calls 75240 7ff71ac996b8 75239->75240 75240->75100 75242 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75241->75242 75243 7ff71adb4ddc 75242->75243 75243->75102 75244->75114 75517 7ff71ac8ad20 75245->75517 75248 7ff71ac8cd80 47 API calls 75249 7ff71ac8e04e 75248->75249 75250 7ff71abf4e10 47 API calls 75249->75250 75251 7ff71abf1d38 75250->75251 75251->75125 75530 7ff71ac917f0 75252->75530 75256 7ff71adb3e60 50 API calls 75255->75256 75257 7ff71ac04421 Concurrency::details::_Scheduler::_Scheduler 75256->75257 75258 7ff71abf0510 67 API calls 75257->75258 75259 7ff71ac0447f 75258->75259 75543 7ff71adb3f40 75259->75543 75261 7ff71ac044a9 Concurrency::details::_Scheduler::_Scheduler UnDecorator::getVbTableType 75262 7ff71abf0510 67 API calls 75261->75262 75263 7ff71ac04517 75262->75263 75264 7ff71adb3f40 55 API calls 75263->75264 75265 7ff71ac04547 UnDecorator::getVbTableType 75264->75265 75564 7ff71adb42a0 75265->75564 75267 7ff71ac04562 Concurrency::details::_Scheduler::_Scheduler 75268 7ff71abf0510 67 API calls 75267->75268 75269 7ff71ac045d1 75268->75269 75270 7ff71adb3f40 55 API calls 75269->75270 75271 7ff71ac04601 UnDecorator::getVbTableType 75270->75271 75271->75132 75357->75117 75358->75121 75374->75222 75376 7ff71abf11a0 _Mpunct 51 API calls 75375->75376 75377 7ff71ad9e49d 75376->75377 75378 7ff71ac398a0 71 API calls 75377->75378 75379 7ff71ad9e4b7 75378->75379 75380 7ff71abf11a0 _Mpunct 51 API calls 75379->75380 75381 7ff71ad9e4dc 75380->75381 75382 7ff71ac398a0 71 API calls 75381->75382 75384 7ff71ad9e4f6 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock Concurrency::details::HardwareAffinity::operator!= shared_ptr 75382->75384 75383 7ff71ad9e5e9 UnDecorator::getVbTableType 75383->75224 75384->75383 75417 7ff71ad992b0 75384->75417 75386 7ff71ad9e7ca Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock shared_ptr 75387 7ff71ad992b0 3 API calls 75386->75387 75392 7ff71ad9e830 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock shared_ptr 75387->75392 75388 7ff71ad9ebfd 75432 7ff71ac57300 SysFreeString 75388->75432 75390 7ff71ad9ec07 75433 7ff71ac57300 SysFreeString 75390->75433 75392->75388 75393 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75392->75393 75394 7ff71ad9e8f6 75393->75394 75395 7ff71ac38e90 71 API calls 75394->75395 75396 7ff71ad9e913 shared_ptr 75395->75396 75397 7ff71ad9e950 SysStringLen 75396->75397 75398 7ff71ad9e96a shared_ptr 75397->75398 75425 7ff71ac249e0 75398->75425 75401 7ff71ac86bb0 allocator 2 API calls 75402 7ff71ad9e9d7 75401->75402 75403 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75402->75403 75407 7ff71ad9ead5 UnDecorator::getVbTableType 75402->75407 75404 7ff71ad9ea04 75403->75404 75405 7ff71ac38e90 71 API calls 75404->75405 75406 7ff71ad9ea21 shared_ptr 75405->75406 75408 7ff71ad9ea5e SysStringLen 75406->75408 75407->75388 75409 7ff71ad9eb7c 75407->75409 75410 7ff71ad9ea78 shared_ptr 75408->75410 75430 7ff71ac57300 SysFreeString 75409->75430 75411 7ff71ac249e0 59 API calls 75410->75411 75414 7ff71ad9ea9d 75411->75414 75413 7ff71ad9eba3 75431 7ff71ac57300 SysFreeString 75413->75431 75416 7ff71ac86bb0 allocator 2 API calls 75414->75416 75416->75407 75418 7ff71ad992c4 75417->75418 75423 7ff71ad992ce 75417->75423 75434 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 75418->75434 75419 7ff71ad992e4 SysAllocStringLen 75422 7ff71ad99302 List 75419->75422 75421 7ff71ad992d6 75421->75386 75422->75421 75435 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 75422->75435 75423->75419 75423->75421 75426 7ff71abfa5a0 57 API calls 75425->75426 75427 7ff71ac249f8 75426->75427 75436 7ff71ac24880 75427->75436 75430->75413 75431->75383 75432->75390 75433->75383 75434->75423 75435->75421 75437 7ff71ac24898 75436->75437 75438 7ff71ac248d8 75437->75438 75448 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 75437->75448 75440 7ff71ac248f1 75438->75440 75449 7ff71abf8370 RtlPcToFileHeader RaiseException Concurrency::cancel_current_task atomic 75438->75449 75442 7ff71ac24927 UnDecorator::getVbTableType 75440->75442 75450 7ff71abfea20 RtlPcToFileHeader RaiseException strrchr 75440->75450 75444 7ff71abfc0d0 UnDecorator::getVbTableType 2 API calls 75442->75444 75445 7ff71ac24945 75444->75445 75446 7ff71ac10d40 UnDecorator::getVbTableType 47 API calls 75445->75446 75447 7ff71ac2496d 75446->75447 75447->75401 75448->75437 75449->75440 75450->75442 75452 7ff71ac21a38 75451->75452 75453 7ff71ac21a6a 75451->75453 75454 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75452->75454 75453->75230 75455 7ff71ac21a42 75454->75455 75455->75453 75456 7ff71ac21a4f 75455->75456 75459 7ff71aca09e0 76 API calls 6 library calls 75456->75459 75458 7ff71ac21a63 75458->75453 75459->75458 75469 7ff71adbbef0 75460->75469 75462 7ff71adcaf9e memcpy_s 75463 7ff71adcb002 WlanAllocateMemory 75462->75463 75464 7ff71adcb02b memcpy_s 75463->75464 75464->75233 75466 7ff71ac8f496 75465->75466 75467 7ff71ac8f4db CoInitializeEx CoInitializeSecurity CoCreateInstance IcmpCreateFile 75466->75467 75468 7ff71abf19e0 75467->75468 75468->75236 75472 7ff71adbbb40 75469->75472 75473 7ff71adbbb71 75472->75473 75476 7ff71adbd9a0 75473->75476 75475 7ff71adbbb7c 75475->75462 75477 7ff71adbd9b3 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 75476->75477 75480 7ff71adb6250 75477->75480 75479 7ff71adbd9ea task 75479->75475 75483 7ff71adbf010 75480->75483 75482 7ff71adb6268 type_info::_name_internal_method 75482->75479 75488 7ff71adb8170 75483->75488 75486 7ff71abeaef0 allocator 49 API calls 75487 7ff71adbf030 75486->75487 75487->75482 75489 7ff71adb81a3 75488->75489 75490 7ff71adb819e 75488->75490 75489->75486 75492 7ff71ac02260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 75490->75492 75492->75489 75496 7ff71ac24a20 75493->75496 75497 7ff71ac24a51 75496->75497 75500 7ff71ac26da0 75497->75500 75499 7ff71ac24a5c 75499->75239 75501 7ff71ac26db3 Concurrency::details::WorkQueue::IsStructuredEmpty _Mpunct 75500->75501 75504 7ff71ac227d0 75501->75504 75503 7ff71ac26dea task 75503->75499 75507 7ff71ac280e0 75504->75507 75506 7ff71ac227e8 type_info::_name_internal_method 75506->75503 75512 7ff71ac237a0 75507->75512 75510 7ff71abeaef0 allocator 49 API calls 75511 7ff71ac28100 75510->75511 75511->75506 75513 7ff71ac237ce 75512->75513 75514 7ff71ac237d3 75512->75514 75516 7ff71ac02260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 75513->75516 75514->75510 75516->75514 75518 7ff71ac8ad3d Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75517->75518 75521 7ff71ac8b530 75518->75521 75520 7ff71ac8ad65 75520->75248 75522 7ff71ac8b550 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75521->75522 75523 7ff71abefc90 4 API calls 75522->75523 75524 7ff71ac8b578 shared_ptr 75523->75524 75525 7ff71ae0fc38 52 API calls 75524->75525 75526 7ff71ac8b5c0 75525->75526 75528 7ff71ac8b5d3 type_info::_name_internal_method 75526->75528 75529 7ff71ade1c68 51 API calls 3 library calls 75526->75529 75528->75520 75537 7ff71ac91860 6 API calls 75530->75537 75532 7ff71ac91808 75533 7ff71ac91860 9 API calls 75532->75533 75534 7ff71ac91820 75533->75534 75535 7ff71ac91860 9 API calls 75534->75535 75536 7ff71ac90421 75535->75536 75536->75127 75541 7ff71ae33ad0 75537->75541 75540 7ff71ac91940 75540->75532 75542 7ff71ac91908 GlobalUnlock CreateStreamOnHGlobal GetLastError 75541->75542 75542->75540 75544 7ff71adb3f7f 75543->75544 75545 7ff71adb4281 75544->75545 75546 7ff71adb4109 75544->75546 75547 7ff71adb3fb7 75544->75547 75545->75261 75549 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75546->75549 75548 7ff71ae02bd0 std::ios_base::_Init 4 API calls 75547->75548 75550 7ff71adb3fd7 75548->75550 75551 7ff71adb4129 75549->75551 75556 7ff71adb4045 75550->75556 75570 7ff71adb3170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 75550->75570 75557 7ff71adb41a9 75551->75557 75573 7ff71adb3170 49 API calls Concurrency::details::SchedulerBase::GetPolicy 75551->75573 75555 7ff71adb41eb shared_ptr 75558 7ff71adb41f9 AppendMenuW 75555->75558 75571 7ff71adb49a0 51 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75556->75571 75574 7ff71ac71f20 51 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75557->75574 75560 7ff71adb4103 75558->75560 75575 7ff71adb3010 51 API calls Concurrency::details::WorkQueue::IsStructuredEmpty 75560->75575 75561 7ff71adb40f5 75572 7ff71adb4340 3 API calls 6 library calls 75561->75572 75565 7ff71adb42c6 75564->75565 75566 7ff71abf0510 67 API calls 75565->75566 75567 7ff71adb42f0 75566->75567 75568 7ff71adb3f40 55 API calls 75567->75568 75569 7ff71adb4322 UnDecorator::getVbTableType 75568->75569 75569->75267 75570->75556 75571->75561 75572->75560 75573->75557 75574->75555 75575->75545 75797 7ff71ac09540 75798 7ff71abf11a0 _Mpunct 51 API calls 75797->75798 75799 7ff71ac0956a 75798->75799 75800 7ff71ac398a0 71 API calls 75799->75800 75801 7ff71ac0957e 75800->75801 75802 7ff71abf11a0 _Mpunct 51 API calls 75801->75802 75803 7ff71ac0959d 75802->75803 75804 7ff71ac398a0 71 API calls 75803->75804 75805 7ff71ac095b1 75804->75805 75824 7ff71ac917a0 ShowWindow 75805->75824 75807 7ff71ac095c6 75808 7ff71abf0510 67 API calls 75807->75808 75809 7ff71ac095d8 75808->75809 75810 7ff71abf0510 67 API calls 75809->75810 75811 7ff71ac095ea 75810->75811 75812 7ff71abf0510 67 API calls 75811->75812 75813 7ff71ac095fc 75812->75813 75814 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75813->75814 75815 7ff71ac09619 75814->75815 75816 7ff71ac38e90 71 API calls 75815->75816 75817 7ff71ac09636 75816->75817 75818 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75817->75818 75819 7ff71ac09680 75818->75819 75820 7ff71ac38e90 71 API calls 75819->75820 75821 7ff71ac0969d 75820->75821 75822 7ff71ac7ca30 76 API calls 75821->75822 75823 7ff71ac096ee UnDecorator::getVbTableType 75822->75823 75825 7ff71ac917ca UpdateWindow 75824->75825 75826 7ff71ac917be 75824->75826 75825->75807 75826->75825 75827 7ff71ac3af80 75828 7ff71abf11a0 _Mpunct 51 API calls 75827->75828 75829 7ff71ac3afaa 75828->75829 75830 7ff71ac398a0 71 API calls 75829->75830 75831 7ff71ac3afbe 75830->75831 75832 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75831->75832 75833 7ff71ac3afd8 75832->75833 75834 7ff71ac38e90 71 API calls 75833->75834 75835 7ff71ac3afec shared_ptr 75834->75835 75836 7ff71ac3affb WinHttpOpen 75835->75836 75837 7ff71ac3b02d UnDecorator::getVbTableType 75836->75837 75838 7ff71ac3b058 WinHttpSetTimeouts 75837->75838 75839 7ff71ac3b040 UnDecorator::getVbTableType 75837->75839 75838->75839 75840 7ff71ac3b0c0 75841 7ff71ac3b0d8 75840->75841 75847 7ff71ac3b0df Concurrency::details::WorkQueue::IsStructuredEmpty 75840->75847 75842 7ff71ac3b1d7 WaitForSingleObject 75842->75841 75842->75847 75844 7ff71ac37740 ReleaseSRWLockExclusive 75844->75847 75846 7ff71ac37690 57 API calls 75846->75847 75847->75842 75847->75844 75847->75846 75848 7ff71ac3ab80 75847->75848 75861 7ff71ac3be70 75847->75861 75849 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75848->75849 75850 7ff71ac3abaa 75849->75850 75851 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75850->75851 75852 7ff71ac3abcf 75851->75852 75853 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75852->75853 75854 7ff71ac3abf4 75853->75854 75855 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75854->75855 75856 7ff71ac3ac19 75855->75856 75857 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75856->75857 75858 7ff71ac3ac3e 75857->75858 75859 7ff71abf0450 Concurrency::details::SchedulerBase::GetPolicy 49 API calls 75858->75859 75860 7ff71ac3ac63 75859->75860 75860->75847 75862 7ff71ac3beb1 std::ios_base::good shared_ptr 75861->75862 75884 7ff71ac3bf50 UnDecorator::getVbTableType 75861->75884 75863 7ff71ac3bf0c WinHttpConnect 75862->75863 75864 7ff71ac3bf57 75863->75864 75865 7ff71abf05d0 59 API calls 75864->75865 75864->75884 75866 7ff71ac3bf6d GetTickCount64 75865->75866 75867 7ff71ac3c2b6 std::ios_base::good shared_ptr 75866->75867 75868 7ff71abfa250 69 API calls 75867->75868 75869 7ff71ac3c387 shared_ptr 75868->75869 75870 7ff71ac3c392 WinHttpOpenRequest 75869->75870 75871 7ff71ac3c3d1 WinHttpSetTimeouts 75870->75871 75876 7ff71ac3c43c UnDecorator::getVbTableType 75870->75876 75872 7ff71ac3c3f9 75871->75872 75871->75876 75873 7ff71ac3c40d 75872->75873 75874 7ff71ac3c401 WinHttpCloseHandle 75872->75874 75875 7ff71ac3c415 WinHttpCloseHandle 75873->75875 75873->75884 75874->75873 75875->75884 75877 7ff71ac3c485 75876->75877 75878 7ff71ac3c455 WinHttpSendRequest 75876->75878 75879 7ff71ac3c49d 75877->75879 75880 7ff71ac3c48c WinHttpReceiveResponse 75877->75880 75878->75877 75881 7ff71ac3c4b1 75879->75881 75882 7ff71ac3c4a5 WinHttpCloseHandle 75879->75882 75880->75879 75883 7ff71ac3c4b9 WinHttpCloseHandle 75881->75883 75881->75884 75882->75881 75883->75884 75884->75847 75885 7ff71ac21e41 75886 7ff71ac21e52 75885->75886 75892 7ff71ac21eb1 75885->75892 75887 7ff71abf5700 type_info::_name_internal_method 7 API calls 75886->75887 75888 7ff71ac21e6c 75887->75888 75893 7ff71ac26d70 75888->75893 75897 7ff71ade4e5c 75893->75897 75895 7ff71ac21e85 75896 7ff71ac25a10 13 API calls 2 library calls 75895->75896 75896->75892 75898 7ff71ade13e8 std::_Lockit::_Lockit 6 API calls 75897->75898 75899 7ff71ade4e85 75898->75899 75900 7ff71ade4f47 75899->75900 75903 7ff71ade4eb6 75899->75903 75902 7ff71ade1810 Concurrency::cancel_current_task 2 API calls 75900->75902 75901 7ff71ade1460 std::_Lockit::~_Lockit LeaveCriticalSection 75904 7ff71ade4f31 75901->75904 75905 7ff71ade4f4c 75902->75905 75903->75901 75904->75895 75906 7ff71abf2c70 std::bad_exception::bad_exception 57 API calls 75905->75906 75907 7ff71ade4f82 75906->75907 75908 7ff71abf4b10 std::bad_exception::bad_exception 19 API calls 75907->75908 75909 7ff71ade4fa2 75908->75909 75909->75895 75910 7ff71ac4ee00 75913 7ff71ac58c10 CoUninitialize 75910->75913 75912 7ff71ac4ee13 75913->75912 75914 7ff71ac75b60 75917 7ff71ac4d4b0 75914->75917 75916 7ff71ac75b7d 75918 7ff71ac4d4d5 75917->75918 75919 7ff71ac4d4dc Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75918->75919 75920 7ff71ac4d535 75918->75920 75935 7ff71ac3d790 75919->75935 75923 7ff71ac4d5bb Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75920->75923 75926 7ff71ac4d558 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75920->75926 75922 7ff71ac4d500 75939 7ff71ac25ad0 51 API calls 2 library calls 75922->75939 75925 7ff71ac3d790 51 API calls 75923->75925 75927 7ff71ac4d5df 75925->75927 75931 7ff71ac4b2c0 75926->75931 75940 7ff71ac25ad0 51 API calls 2 library calls 75927->75940 75930 7ff71ac4d524 75930->75916 75932 7ff71ac4b2d8 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75931->75932 75941 7ff71ac42850 75932->75941 75936 7ff71ac3d7c6 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75935->75936 75987 7ff71ac52610 75936->75987 75938 7ff71ac3d7d3 task 75938->75922 75939->75930 75940->75930 75942 7ff71ac42889 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75941->75942 75943 7ff71ac428a2 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75941->75943 75964 7ff71ac42200 51 API calls 2 library calls 75942->75964 75947 7ff71ac43110 75943->75947 75946 7ff71ac428a0 75946->75930 75948 7ff71ac43133 Concurrency::details::WorkQueue::IsStructuredEmpty 75947->75948 75949 7ff71ac431b1 75948->75949 75972 7ff71ac1b0d0 51 API calls Concurrency::task_continuation_context::task_continuation_context 75948->75972 75965 7ff71ac12150 75949->75965 75952 7ff71ac431e5 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75968 7ff71ac4ac60 75952->75968 75955 7ff71ac4329e 75974 7ff71ac14e20 51 API calls 2 library calls 75955->75974 75956 7ff71ac4327c 75973 7ff71ac14e20 51 API calls 2 library calls 75956->75973 75959 7ff71ac4329b 75976 7ff71ac1ab70 51 API calls 2 library calls 75959->75976 75960 7ff71ac432bd 75975 7ff71ac14e20 51 API calls 2 library calls 75960->75975 75963 7ff71ac43314 75963->75946 75964->75946 75977 7ff71ac1b140 75965->75977 75969 7ff71ac4ac82 construct Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75968->75969 75970 7ff71ac3d790 51 API calls 75969->75970 75971 7ff71ac43253 75970->75971 75971->75955 75971->75956 75972->75949 75973->75959 75974->75960 75975->75959 75976->75963 75982 7ff71ac13f70 75977->75982 75980 7ff71abeaef0 allocator 49 API calls 75981 7ff71ac12170 75980->75981 75981->75952 75983 7ff71ac13f9e 75982->75983 75984 7ff71ac13fa3 75982->75984 75986 7ff71ac02260 RtlPcToFileHeader RaiseException stdext::threads::lock_error::lock_error Concurrency::cancel_current_task 75983->75986 75984->75980 75986->75984 75988 7ff71ac52628 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75987->75988 75991 7ff71ac3eab0 75988->75991 75992 7ff71ac3eacd Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 75991->75992 75995 7ff71ac52740 75992->75995 75998 7ff71ac4aad0 75995->75998 75997 7ff71ac3eada 75997->75938 76001 7ff71ac18af0 75998->76001 76000 7ff71ac4aaf5 task 76000->75997 76004 7ff71ac158b0 76001->76004 76005 7ff71ac158c3 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock Concurrency::details::_Scheduler::_Scheduler 76004->76005 76012 7ff71ac1b110 76005->76012 76007 7ff71ac158e1 std::error_category::equivalent Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 76017 7ff71ac15590 76007->76017 76009 7ff71ac15926 type_info::_name_internal_method 76021 7ff71ac19380 47 API calls Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 76009->76021 76011 7ff71ac15940 76011->76000 76022 7ff71ac13ff0 76012->76022 76015 7ff71abeaef0 allocator 49 API calls 76016 7ff71ac1b130 76015->76016 76016->76007 76018 7ff71ac155b2 construct Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock 76017->76018 76019 7ff71abf0e90 std::_Throw_Cpp_error 51 API calls 76018->76019 76020 7ff71ac155d5 76019->76020 76020->76009 76021->76011 76023 7ff71ac1401e 76022->76023 76024 7ff71ac14023 76022->76024 76025 7ff71ac02260 allocator RtlPcToFileHeader RaiseException 76023->76025 76024->76015 76025->76024 76026 7ff71ac725a0 76034 7ff71abed210 76026->76034 76028 7ff71ac725c1 RegCreateKeyW 76029 7ff71ac725dc shared_ptr 76028->76029 76033 7ff71ac7263f UnDecorator::getVbTableType 76028->76033 76030 7ff71ac725e6 RegSetValueExW 76029->76030 76031 7ff71ac72624 RegCloseKey 76030->76031 76032 7ff71ac72652 RegCloseKey 76030->76032 76031->76033 76032->76033 76034->76028

                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                      Function 00007FF71AC695B0 Relevance: 88.4, APIs: 39, Strings: 11, Instructions: 865timeCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 0 7ff71ac695b0-7ff71ac69672 call 7ff71abf1200 * 2 call 7ff71ac2ca20 call 7ff71abf0510 call 7ff71abed210 call 7ff71ac543b0 call 7ff71ac54e20 call 7ff71ac4f650 17 7ff71ac69678-7ff71ac696dc call 7ff71ac58170 call 7ff71ac75ad0 call 7ff71ac05cb0 0->17 18 7ff71ac69741 0->18 17->18 41 7ff71ac696de-7ff71ac69732 call 7ff71ac58170 call 7ff71ac75ad0 call 7ff71ac05cb0 17->41 19 7ff71ac6974c-7ff71ac69761 18->19 21 7ff71ac69776-7ff71ac6977f 19->21 22 7ff71ac69763-7ff71ac69775 call 7ff71abf3c10 19->22 26 7ff71ac69794-7ff71ac6979b 21->26 27 7ff71ac69781-7ff71ac69793 call 7ff71abf3c10 21->27 22->21 31 7ff71ac697a1-7ff71ac6982d call 7ff71ac75a70 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71ac75a70 call 7ff71abf5040 call 7ff71abf3c10 26->31 32 7ff71ac69832-7ff71ac69974 call 7ff71abf05d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71ac3d390 call 7ff71ae03da0 call 7ff71abf3680 * 2 26->32 27->26 69 7ff71ac69975-7ff71ac69a40 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 WinHttpOpen call 7ff71abf3680 31->69 32->69 41->18 61 7ff71ac69734-7ff71ac6973f 41->61 61->19 93 7ff71ac69b4d-7ff71ac69b73 WinHttpSetTimeouts 69->93 94 7ff71ac69a46-7ff71ac69b4c call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 69->94 96 7ff71ac69c8c-7ff71ac69cba call 7ff71ac03200 WinHttpConnect 93->96 97 7ff71ac69b79-7ff71ac69c8b WinHttpCloseHandle call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 93->97 94->93 106 7ff71ac69dd3-7ff71ac69eda call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71ac03200 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 WinHttpOpenRequest call 7ff71abf3680 96->106 107 7ff71ac69cc0-7ff71ac69dd2 WinHttpCloseHandle call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 96->107 97->96 162 7ff71ac69ffe-7ff71ac6a038 WinHttpSendRequest 106->162 163 7ff71ac69ee0-7ff71ac69ffd WinHttpCloseHandle * 2 call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 106->163 107->106 166 7ff71ac6a03e-7ff71ac6a04d WinHttpReceiveResponse 162->166 167 7ff71ac6a1a8-7ff71ac6a2d0 WinHttpCloseHandle * 3 call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 162->167 163->162 166->167 170 7ff71ac6a053-7ff71ac6a09c WinHttpQueryHeaders 166->170 175 7ff71ac6a2d1-7ff71ac6a304 call 7ff71abf1680 call 7ff71ac542e0 167->175 173 7ff71ac6a1a3 170->173 174 7ff71ac6a0a2-7ff71ac6a0ab GetLastError 170->174 173->175 174->173 178 7ff71ac6a0b1-7ff71ac6a0b6 174->178 197 7ff71ac6a30a-7ff71ac6a336 call 7ff71abed210 call 7ff71ac541a0 175->197 198 7ff71ac6a493-7ff71ac6a4bb call 7ff71abf1390 call 7ff71ac583c0 175->198 178->173 182 7ff71ac6a0bc-7ff71ac6a14d call 7ff71abf1200 call 7ff71ac0c710 call 7ff71ac0c1b0 call 7ff71ac03200 WinHttpQueryHeaders call 7ff71ac0c710 178->182 236 7ff71ac6a195-7ff71ac6a1a2 call 7ff71abf3c10 182->236 237 7ff71ac6a14f-7ff71ac6a194 call 7ff71ac545f0 call 7ff71ac57cb0 call 7ff71ac360e0 182->237 219 7ff71ac6a33b-7ff71ac6a389 call 7ff71ac578d0 call 7ff71ac59330 call 7ff71ac6e640 197->219 223 7ff71ac6a4bd-7ff71ac6a4e0 call 7ff71ac3e7c0 198->223 224 7ff71ac6a4e1-7ff71ac6a4ed 198->224 219->198 260 7ff71ac6a38f-7ff71ac6a492 WinHttpCloseHandle * 3 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d390 call 7ff71ae03da0 call 7ff71abf3680 * 2 219->260 223->224 231 7ff71ac6a4f2-7ff71ac6a504 call 7ff71ac58ed0 224->231 244 7ff71ac6a84b-7ff71ac6a855 231->244 245 7ff71ac6a50a-7ff71ac6a524 WinHttpQueryDataAvailable 231->245 236->173 237->236 253 7ff71ac6a857-7ff71ac6a85f call 7ff71ac66510 244->253 254 7ff71ac6a865-7ff71ac6a952 WinHttpCloseHandle * 3 call 7ff71abf3ce0 call 7ff71ac59330 call 7ff71ac19470 call 7ff71abf3680 * 2 call 7ff71ac571a0 call 7ff71ac56f70 call 7ff71abf3680 call 7ff71abf3c10 * 3 call 7ff71abf3ce0 * 2 244->254 249 7ff71ac6a52a-7ff71ac6a630 call 7ff71abf11a0 call 7ff71ac398a0 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac3d3e0 call 7ff71ae03da0 call 7ff71abf3680 * 2 245->249 250 7ff71ac6a631-7ff71ac6a636 245->250 249->250 258 7ff71ac6a638-7ff71ac6a63d 250->258 259 7ff71ac6a642-7ff71ac6a6c4 call 7ff71ac1bc10 call 7ff71ac72b60 call 7ff71ac72c10 call 7ff71ac75190 call 7ff71ac02900 WinHttpReadData 250->259 262 7ff71ac6a864 253->262 258->244 306 7ff71ac6a6ca-7ff71ac6a6d4 259->306 307 7ff71ac6a83f-7ff71ac6a844 259->307 260->198 262->254 312 7ff71ac6a6da-7ff71ac6a713 call 7ff71ac02900 call 7ff71ac774d0 306->312 313 7ff71ac6a770-7ff71ac6a837 call 7ff71abf1200 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71ac4a240 call 7ff71ac03200 call 7ff71ac774d0 call 7ff71abf3c10 306->313 307->244 333 7ff71ac6a718-7ff71ac6a72b call 7ff71ac583c0 312->333 358 7ff71ac6a83c-7ff71ac6a846 313->358 333->313 342 7ff71ac6a72d-7ff71ac6a736 333->342 342->313 345 7ff71ac6a738-7ff71ac6a76f call 7ff71ac58e40 342->345 345->313 358->231
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Http$CloseHandle$Concurrency::details::EmptyErrorLastQueue::StructuredWork$shared_ptr$Query$Concurrency::details::_CriticalDataHeadersLock::_OpenReentrantRequestScoped_lockScoped_lock::~_type_info::_name_internal_method$AvailableChar_traitsConnectDecorator::getExceptionFileHeaderListRaiseReadReceiveResponseSafeSendTableTimeoutsType
                                                                                                                                                                                      • String ID: GET$URL format is not valid : %ws$WinHTTP 1.0$^(https?://(?:www.)?([^/]+))(/.*)?$$file creation failure$handle connection failure$handle initialization failure$handle request creation failure$handle request or response failure$query data not available$timeout init failure
                                                                                                                                                                                      • API String ID: 5397687-202491335
                                                                                                                                                                                      • Opcode ID: 5fefc767e726ca864645e5207356e9896e8be9106bcf447c85e2ee45cfe5cd94
                                                                                                                                                                                      • Instruction ID: 81274b07af3511042fd6b11f0757023f7980b88e71052a68d44afb91ec3971db
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5fefc767e726ca864645e5207356e9896e8be9106bcf447c85e2ee45cfe5cd94
                                                                                                                                                                                      • Instruction Fuzzy Hash: ABA2F53260DEC295EA70AB14E8913EBF364FBC5750F800576D68D83AAADF2CD549CB50
                                                                                                                                                                                      Function 00007FF71AC4BFE0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 210libraryloaderCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 3244 7ff71ac4bfe0-7ff71ac4c003 3245 7ff71ac4c005-7ff71ac4c04d call 7ff71abf2a70 3244->3245 3246 7ff71ac4c052-7ff71ac4c09a call 7ff71ac4ef00 3244->3246 3253 7ff71ac4c41c-7ff71ac4c423 3245->3253 3252 7ff71ac4c0a4-7ff71ac4c0d1 call 7ff71abf2a70 call 7ff71ac10720 * 2 3246->3252 3260 7ff71ac4c17c-7ff71ac4c188 call 7ff71ac10720 3252->3260 3261 7ff71ac4c0d7-7ff71ac4c0fd LoadLibraryW GetProcAddress 3252->3261 3267 7ff71ac4c18a-7ff71ac4c1a1 call 7ff71abf2a70 3260->3267 3268 7ff71ac4c1a6-7ff71ac4c209 call 7ff71ac54790 call 7ff71ac720d0 call 7ff71ae3387c call 7ff71abebc20 * 2 call 7ff71ac3e190 3260->3268 3262 7ff71ac4c11a-7ff71ac4c178 call 7ff71abf2a70 3261->3262 3263 7ff71ac4c0ff-7ff71ac4c115 3261->3263 3262->3260 3263->3253 3267->3253 3286 7ff71ac4c212-7ff71ac4c232 call 7ff71ac72fb0 3268->3286 3289 7ff71ac4c3de-7ff71ac4c414 call 7ff71abed210 call 7ff71ae33882 call 7ff71abf3c10 call 7ff71ac57010 3286->3289 3290 7ff71ac4c238-7ff71ac4c2a8 call 7ff71ac0c710 call 7ff71abf7170 call 7ff71ac03200 LoadLibraryW call 7ff71abf02f0 call 7ff71ac0a8b0 call 7ff71ac0c710 call 7ff71ac58400 3286->3290 3289->3253 3313 7ff71ac4c2ba-7ff71ac4c2de call 7ff71abed210 GetProcAddress 3290->3313 3314 7ff71ac4c2aa-7ff71ac4c2b5 call 7ff71ac57090 3290->3314 3319 7ff71ac4c2f0-7ff71ac4c348 call 7ff71ac54790 call 7ff71ac720d0 3313->3319 3320 7ff71ac4c2e0-7ff71ac4c2eb call 7ff71ac57090 3313->3320 3314->3286 3328 7ff71ac4c34a-7ff71ac4c35f call 7ff71ac57010 call 7ff71ac57090 3319->3328 3329 7ff71ac4c364-7ff71ac4c3c2 call 7ff71ac0bcd0 call 7ff71ac67f50 call 7ff71abf2a70 call 7ff71ac57010 call 7ff71ac57090 call 7ff71abf3c10 call 7ff71ac57010 3319->3329 3320->3286 3328->3286 3329->3253
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: atomic$AddressLibraryLoadProc
                                                                                                                                                                                      • String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$combase.dll
                                                                                                                                                                                      • API String ID: 1653574484-4170001172
                                                                                                                                                                                      • Opcode ID: ab9e4ff226939bb9caa6408bd62fe8e08133204916e437274b7cecacb9bf7b9d
                                                                                                                                                                                      • Instruction ID: 0f7ae8413534d626eef9321c368a73cf856bf0e6fb42fd6b78090818dfba9588
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab9e4ff226939bb9caa6408bd62fe8e08133204916e437274b7cecacb9bf7b9d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 45B1CC3660CE8681EA70FB15E4513BBE761EBD47A0F804173E68D43AAADF2CD549CB50
                                                                                                                                                                                      Function 00007FF71AC91860 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59memoryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: GlobalResource$LockName$AllocCreateErrorFindLastLoadNodeNode::SizeofStreamUnlock
                                                                                                                                                                                      • String ID: &$PNG
                                                                                                                                                                                      • API String ID: 404809873-3047161795
                                                                                                                                                                                      • Opcode ID: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                      • Instruction ID: 132a54f473a8478f29bda1d8e5ba9a40a497fe128409966e711cf68b50d79032
                                                                                                                                                                                      • Opcode Fuzzy Hash: a2c06dc25bda38559360ae671d947d6f58e99bb9c09f315c507cbfd297364e45
                                                                                                                                                                                      • Instruction Fuzzy Hash: BE31BC36518F8586EB60AB25F45532BB7B4FB88795F504076EA8E43B68DF3CD1488B10
                                                                                                                                                                                      Function 00007FF71ABF8790 Relevance: 18.0, APIs: 2, Strings: 8, Instructions: 500COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: .\nwjs\NW_store.exe$.\ui\.$UI StartedMain process ID:%d$creation_error=%ws$directory_switching_error$product$ui_creation_failed$ui_termination_error
                                                                                                                                                                                      • API String ID: 1646997740-2964731665
                                                                                                                                                                                      • Opcode ID: c3742bc78813d2f9a77c2a1ed2c4afb258c01f60c4138c0005197e6aa379c71e
                                                                                                                                                                                      • Instruction ID: 7026d415c22bc709a813f3667336e9ad9c783bee9daf6b0c358d83c264a11803
                                                                                                                                                                                      • Opcode Fuzzy Hash: c3742bc78813d2f9a77c2a1ed2c4afb258c01f60c4138c0005197e6aa379c71e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4842CA3250DFC2A1EA71AB14E8913EBB364FBC5750F801576D68C82BA9EF2CD558CB50
                                                                                                                                                                                      Function 00007FF71AE31274 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                      • Opcode ID: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                      • Instruction ID: 9c61610c0bacfcfaa09e6e8803fe305824e8a9664dad116af313a77d4b5e36b3
                                                                                                                                                                                      • Opcode Fuzzy Hash: e343539a376f2db1ff088acd6fe61eef78b7cbf5639aa4d1d11734894c44e91c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2FC1D232B14F4185FB10EFA9C4922AE7775EB49BA8F41427ADA1E97794CF38D059C310
                                                                                                                                                                                      Function 00007FF71AC75130 Relevance: 3.0, APIs: 2, Instructions: 14keyboardCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: keybd_event
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2665452162-0
                                                                                                                                                                                      • Opcode ID: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                      • Instruction ID: 31a8fbe3dff3d2fc6c9a558485b8aa976c1fd5fad71e44b3f5167c2bdb755f17
                                                                                                                                                                                      • Opcode Fuzzy Hash: a042bddbd6d60c66f133c626703260ee003b2161beff19cb918841546142377a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DD0C970B114A342FBA03B717C6BF960FA06B59BC9FA2B461C9040BB40CD1A224D0760
                                                                                                                                                                                      Function 00007FF71AC33D10 Relevance: 55.6, APIs: 9, Strings: 22, Instructions: 1375filesynchronizationCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 360 7ff71ac33d10-7ff71ac347f0 call 7ff71ae02f90 call 7ff71abf0350 call 7ff71ac2fab0 call 7ff71abf2bd0 CoInitializeEx call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf05d0 call 7ff71abed210 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf05d0 call 7ff71ac36ea0 call 7ff71abed210 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71abf05d0 call 7ff71abed210 call 7ff71ac36ea0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0450 call 7ff71ac8db90 call 7ff71abf1390 * 2 call 7ff71ac32880 call 7ff71ac695b0 call 7ff71ac360e0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 513 7ff71ac349f1-7ff71ac349f8 360->513 514 7ff71ac347f6-7ff71ac349f0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac8db90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac8db90 call 7ff71abf3680 * 2 360->514 515 7ff71ac349fe-7ff71ac34ad2 call 7ff71ae34170 * 2 call 7ff71abed210 * 2 ShellExecuteExW 513->515 516 7ff71ac35880-7ff71ac359af call 7ff71abf3680 * 6 call 7ff71abf05d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 513->516 514->513 543 7ff71ac34ad8-7ff71ac34bca call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac332d0 call 7ff71ae03da0 call 7ff71abf3680 * 2 515->543 544 7ff71ac34bcf-7ff71ac354d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf05d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71abf05d0 call 7ff71abed210 call 7ff71ac36ea0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0450 call 7ff71ac8db90 WaitForSingleObject GetExitCodeProcess call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71abf05d0 call 7ff71abed210 call 7ff71ac36ea0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0450 call 7ff71ac8db90 CloseHandle call 7ff71abed210 DeleteFileW 515->544 615 7ff71ac35a3a-7ff71ac35aac call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 516->615 616 7ff71ac359b5-7ff71ac359bc 516->616 543->516 827 7ff71ac357e6-7ff71ac357ee call 7ff71ac65f00 544->827 828 7ff71ac354d6-7ff71ac357e5 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf05d0 call 7ff71abed210 GetLastError call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 7 544->828 637 7ff71ac35ab4-7ff71ac35ad3 call 7ff71abf0510 615->637 616->615 617 7ff71ac359be-7ff71ac35a38 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 616->617 617->637 642 7ff71ac35ae8-7ff71ac35af1 637->642 643 7ff71ac35ad5-7ff71ac35ae7 call 7ff71abf3680 637->643 646 7ff71ac35b06-7ff71ac35b1b call 7ff71abf05d0 642->646 647 7ff71ac35af3-7ff71ac35b05 call 7ff71abf3680 642->647 643->642 656 7ff71ac35b1d-7ff71ac35b24 646->656 657 7ff71ac35b30 646->657 647->646 656->657 659 7ff71ac35b26-7ff71ac35b2e 656->659 661 7ff71ac35b38-7ff71ac35ed2 call 7ff71abed210 call 7ff71ac36ea0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0450 call 7ff71ac8db90 call 7ff71abed210 call 7ff71ac36ea0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0450 call 7ff71ac8db90 call 7ff71abf3680 * 10 call 7ff71abf46c0 657->661 659->661 777 7ff71ac35ed7-7ff71ac35f42 call 7ff71abf3680 * 5 call 7ff71abf3ce0 * 2 661->777 831 7ff71ac357f3-7ff71ac3580a 827->831 828->827 833 7ff71ac3580c-7ff71ac35811 831->833 834 7ff71ac35813 831->834 836 7ff71ac35818-7ff71ac3587f call 7ff71abf3680 * 7 833->836 834->836 836->516
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71AC33D65
                                                                                                                                                                                      • CoInitializeEx.OLE32 ref: 00007FF71AC33D9F
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                        • Part of subcall function 00007FF71AC7CA30: Concurrency::cancellation_token::_FromImpl.LIBCPMTD ref: 00007FF71AC7CAA0
                                                                                                                                                                                        • Part of subcall function 00007FF71AC7CA30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC7CAB9
                                                                                                                                                                                      • ShellExecuteExW.SHELL32 ref: 00007FF71AC34ACA
                                                                                                                                                                                      • Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_error.LIBCMTD ref: 00007FF71AC34B93
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32 ref: 00007FF71AC35030
                                                                                                                                                                                      • GetExitCodeProcess.KERNEL32 ref: 00007FF71AC3504B
                                                                                                                                                                                      • CloseHandle.KERNEL32 ref: 00007FF71AC354B1
                                                                                                                                                                                      • DeleteFileW.KERNEL32 ref: 00007FF71AC354C8
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF71AC3558B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCodeConcurrency::cancellation_token::_Concurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorDecorator::getDeleteErrorExecuteExitFac_nodeFac_node::_FileFromHandleImplInitializeLastObjectProcessShellSingleTableTypeWaitstd::_type_info::_name_internal_method
                                                                                                                                                                                      • String ID: 71434D56-1548-ED3D-AEE6-C75AECD93BF0$@$Execution failure$delete_error$dl_start$dl_successful$eC=%d&oid=%d&entry_app=%ws$exec_end$exec_start$h$https://pcapp.store/dl_cta_open.php?guid=%ws&oid=%lu&entryApp=%ws$installed$none$oid=%d&entry_app=%ws$oid=%d&entry_app=%ws&exitCode=%d$oid=%d&entry_app=%ws&source=%ws$p$product${"app" : {"%ws" : {"dl_app_result" : {"name":"%ws","status" : %d}}}}${"app": {"notifications": {"offerIsOpen": false}}}${"app":{"%ws":{"app_status":{"name":"%ws","status":"%ws"}}}}${"app":{"offer": {"offerInfo":{"oid":0,"otype":""}},"hide_window":"offer"}}
                                                                                                                                                                                      • API String ID: 2903385420-610885355
                                                                                                                                                                                      • Opcode ID: e3b5d4f9505bcad0d44b891350c4d779035ca62be7cb4e6df8de5739d846bcfe
                                                                                                                                                                                      • Instruction ID: 7cb439d4902371cd9e944c0b9272331b4479d147d896072b42a00e012921c683
                                                                                                                                                                                      • Opcode Fuzzy Hash: e3b5d4f9505bcad0d44b891350c4d779035ca62be7cb4e6df8de5739d846bcfe
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4003B33660DFC295EA70AB14E8902EBB3A4FBC4750F805166D68D83B69EF3CD558CB50
                                                                                                                                                                                      Function 00007FF71AC06570 Relevance: 54.4, APIs: 15, Strings: 15, Instructions: 1912COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 898 7ff71ac06570-7ff71ac06db1 call 7ff71ae02f90 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1049 7ff71ac06f10-7ff71ac06fc9 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 898->1049 1050 7ff71ac06db7-7ff71ac06e38 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac5a800 call 7ff71abf3680 898->1050 1084 7ff71ac06fd0-7ff71ac070d9 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1049->1084 1067 7ff71ac06e3a-7ff71ac06e46 1050->1067 1068 7ff71ac06e48-7ff71ac06e4f 1050->1068 1070 7ff71ac06e54-7ff71ac06f0b call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1067->1070 1068->1070 1070->1084 1105 7ff71ac07203-7ff71ac072bc call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1084->1105 1106 7ff71ac070df-7ff71ac071e5 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1084->1106 1140 7ff71ac072c3-7ff71ac073cc call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1105->1140 1147 7ff71ac071ee 1106->1147 1148 7ff71ac071e7-7ff71ac071ec 1106->1148 1157 7ff71ac074f6-7ff71ac075af call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1140->1157 1158 7ff71ac073d2-7ff71ac074d8 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1140->1158 1150 7ff71ac071f3-7ff71ac071fe 1147->1150 1148->1150 1150->1140 1192 7ff71ac075b6-7ff71ac076bf call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1157->1192 1200 7ff71ac074e1 1158->1200 1201 7ff71ac074da-7ff71ac074df 1158->1201 1209 7ff71ac076c5-7ff71ac077cb call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1192->1209 1210 7ff71ac077e2-7ff71ac0789b call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1192->1210 1203 7ff71ac074e6-7ff71ac074f1 1200->1203 1201->1203 1203->1192 1252 7ff71ac077d6 1209->1252 1253 7ff71ac077cd-7ff71ac077d4 1209->1253 1243 7ff71ac078a2-7ff71ac079ab call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1210->1243 1261 7ff71ac079b1-7ff71ac07ab7 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1243->1261 1262 7ff71ac07adb-7ff71ac07b94 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1243->1262 1255 7ff71ac077dd 1252->1255 1253->1255 1255->1243 1303 7ff71ac07ac3 1261->1303 1304 7ff71ac07ab9-7ff71ac07ac1 1261->1304 1295 7ff71ac07b9b-7ff71ac07ca4 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1262->1295 1313 7ff71ac07dce-7ff71ac07e87 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1295->1313 1314 7ff71ac07caa-7ff71ac07db0 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1295->1314 1306 7ff71ac07acb-7ff71ac07ad6 1303->1306 1304->1306 1306->1295 1348 7ff71ac07e8e-7ff71ac07f97 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1313->1348 1355 7ff71ac07db2-7ff71ac07db7 1314->1355 1356 7ff71ac07db9 1314->1356 1365 7ff71ac080c1-7ff71ac0817a call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1348->1365 1366 7ff71ac07f9d-7ff71ac080a3 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1348->1366 1358 7ff71ac07dbe-7ff71ac07dc9 1355->1358 1356->1358 1358->1348 1400 7ff71ac08181-7ff71ac0828a call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1365->1400 1408 7ff71ac080a5-7ff71ac080aa 1366->1408 1409 7ff71ac080ac 1366->1409 1417 7ff71ac08290-7ff71ac08396 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1400->1417 1418 7ff71ac083b4-7ff71ac0846d call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1400->1418 1411 7ff71ac080b1-7ff71ac080bc 1408->1411 1409->1411 1411->1400 1460 7ff71ac08398-7ff71ac0839d 1417->1460 1461 7ff71ac0839f 1417->1461 1451 7ff71ac08474-7ff71ac0857d call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1418->1451 1469 7ff71ac086ad-7ff71ac08766 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1451->1469 1470 7ff71ac08583-7ff71ac08689 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1451->1470 1463 7ff71ac083a4-7ff71ac083af 1460->1463 1461->1463 1463->1451 1503 7ff71ac0876d-7ff71ac08876 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1469->1503 1511 7ff71ac0868b-7ff71ac08693 1470->1511 1512 7ff71ac08695 1470->1512 1521 7ff71ac0887c-7ff71ac08982 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1503->1521 1522 7ff71ac089a0-7ff71ac08a59 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1503->1522 1514 7ff71ac0869d-7ff71ac086a8 1511->1514 1512->1514 1514->1503 1563 7ff71ac0898b 1521->1563 1564 7ff71ac08984-7ff71ac08989 1521->1564 1556 7ff71ac08a60-7ff71ac08b69 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1522->1556 1573 7ff71ac08b6f-7ff71ac08c75 call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1556->1573 1574 7ff71ac08c93-7ff71ac08d4c call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1556->1574 1566 7ff71ac08990-7ff71ac0899b 1563->1566 1564->1566 1566->1556 1616 7ff71ac08c77-7ff71ac08c7c 1573->1616 1617 7ff71ac08c7e 1573->1617 1608 7ff71ac08d53-7ff71ac08e5c call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1574->1608 1625 7ff71ac08fbb-7ff71ac09074 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1608->1625 1626 7ff71ac08e62-7ff71ac08ee3 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac5a800 call 7ff71abf3680 1608->1626 1619 7ff71ac08c83-7ff71ac08c8e 1616->1619 1617->1619 1619->1608 1660 7ff71ac0907b-7ff71ac09184 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 1625->1660 1643 7ff71ac08ef3-7ff71ac08efa 1626->1643 1644 7ff71ac08ee5-7ff71ac08ef1 1626->1644 1646 7ff71ac08eff-7ff71ac08fb6 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1643->1646 1644->1646 1646->1660 1681 7ff71ac0918a-7ff71ac0928b call 7ff71ac104f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5040 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 1660->1681 1682 7ff71ac09290-7ff71ac09348 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 1660->1682 1716 7ff71ac09349-7ff71ac09425 call 7ff71abf3680 * 2 call 7ff71abf3c10 * 13 1681->1716 1682->1716
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72347
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegQueryValueExW.KERNEL32 ref: 00007FF71AC72392
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.ADVAPI32 ref: 00007FF71AC723A1
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC06FA7
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71AC5A800: std::ios_base::good.LIBCPMTD ref: 00007FF71AC5A9E1
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC06EE9
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC0729A
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC0758D
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC07879
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.KERNEL32 ref: 00007FF71AC723CD
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC07E65
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC08158
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC0844B
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC08744
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC08A37
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC08D2A
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC08F94
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC09052
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC07B72
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF506B
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF5040: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF507A
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC09327
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Close$Char_traitsCreateQueryValuestd::ios_base::good
                                                                                                                                                                                      • String ID: PCAppStore$PCAppStoreUpdater$auto_start_on$browser_activity$browser_search$btn_x_close$contextual_offers$hardware_collecting$link_substitution$periodical_offers$personilized_notifications$search_menu$should_auto_update$software_collecting$start_menu_on
                                                                                                                                                                                      • API String ID: 2434849288-4189071652
                                                                                                                                                                                      • Opcode ID: cd352e8fb8544b10cc1674d306c98bc56474d10c2959cab3d867ceb2d3e065e0
                                                                                                                                                                                      • Instruction ID: 8d943bf3afe966a055a6f40f75e9dac5be3769cff8eb28f47a1f2099ade4999f
                                                                                                                                                                                      • Opcode Fuzzy Hash: cd352e8fb8544b10cc1674d306c98bc56474d10c2959cab3d867ceb2d3e065e0
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9933C43260EFC294EA70AB14E8902EBB3A4FBC5750F804576D6CD87B5ADE2CD558CB50
                                                                                                                                                                                      Function 00007FF71ABFB130 Relevance: 47.9, APIs: 13, Strings: 14, Instructions: 636registryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 1750 7ff71abfb130-7ff71abfb23b call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abf3680 RegisterClassExW 1763 7ff71abfb24d-7ff71abfb348 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 CreateWindowExW call 7ff71abf3680 1750->1763 1764 7ff71abfb23d-7ff71abfb248 call 7ff71abf3680 1750->1764 1776 7ff71abfb35a-7ff71abfb5ba ShowWindow call 7ff71ae02956 call 7ff71abf1200 call 7ff71ac0c710 call 7ff71ac0c1b0 call 7ff71abf1200 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf5950 call 7ff71abf5880 call 7ff71abf3680 * 3 1763->1776 1777 7ff71abfb34a-7ff71abfb355 call 7ff71abf3680 1763->1777 1769 7ff71abfc03b-7ff71abfc043 1764->1769 1816 7ff71abfb5bb-7ff71abfb5cc 1776->1816 1777->1769 1817 7ff71abfb5d2-7ff71abfb633 call 7ff71abf50c0 GetForegroundWindow call 7ff71ac03200 GetWindowTextW call 7ff71ac060e0 1816->1817 1818 7ff71abfbfd8-7ff71abfc03a call 7ff71ae0295c call 7ff71abf3680 * 3 call 7ff71abf3c10 * 2 call 7ff71abf3680 1816->1818 1831 7ff71abfb635-7ff71abfb64e call 7ff71ac060e0 1817->1831 1832 7ff71abfb662-7ff71abfb68c PeekMessageW 1817->1832 1818->1769 1831->1832 1844 7ff71abfb650-7ff71abfb659 1831->1844 1835 7ff71abfb692-7ff71abfb6ba TranslateMessage DispatchMessageW 1832->1835 1836 7ff71abfbe21-7ff71abfbe2c SleepEx 1832->1836 1841 7ff71abfb6c0-7ff71abfba68 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 5 call 7ff71ac0d500 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03b30 call 7ff71abf3680 * 5 1835->1841 1842 7ff71abfba6d-7ff71abfba78 1835->1842 1840 7ff71abfbe2d-7ff71abfbe36 1836->1840 1845 7ff71abfbe51-7ff71abfbe7c call 7ff71abed210 OpenEventW 1840->1845 1846 7ff71abfbe38 1840->1846 1847 7ff71abfbe1f 1841->1847 1842->1847 1848 7ff71abfba7e-7ff71abfbe1e call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 5 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03b30 call 7ff71abf3680 * 5 1842->1848 1844->1832 1852 7ff71abfb65b 1844->1852 1861 7ff71abfbfd3 1845->1861 1862 7ff71abfbe82-7ff71abfbe94 WaitForSingleObject 1845->1862 1853 7ff71abfbe38 call 7ff71ac5ab70 1846->1853 1847->1840 1848->1847 1852->1832 1858 7ff71abfbe3d-7ff71abfbe42 1853->1858 1864 7ff71abfbe44 call 7ff71ac75130 1858->1864 1865 7ff71abfbe4a 1858->1865 1861->1816 1862->1861 1868 7ff71abfbe9a-7ff71abfbfd2 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac8db90 CloseHandle call 7ff71abf3c10 1862->1868 1874 7ff71abfbe49 1864->1874 1865->1845 1868->1861 1874->1865
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • RegisterClassExW.USER32 ref: 00007FF71ABFB230
                                                                                                                                                                                      • CreateWindowExW.USER32 ref: 00007FF71ABFB31B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassCreateRegisterWindowtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: ENDING_EVT_HANDLER$Local$P$PCAppStore$Windows Default Lock Screen$logoff$msg=logoff$msg=shutdown$product$product$shutdown$system_event$system_event${"app":{"menu_search":{"search_request":"", "page":"b"},"show_window": "menu_search"}}
                                                                                                                                                                                      • API String ID: 331722943-4236414880
                                                                                                                                                                                      • Opcode ID: 714c6d516fd589a594f79f0f4c3e77747f1a69a133319e79bcbbd6069c529ac2
                                                                                                                                                                                      • Instruction ID: 992c83093e03900d7981fb45984f4c5169f8c1c2d516a02f1e615ee5c15930a2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 714c6d516fd589a594f79f0f4c3e77747f1a69a133319e79bcbbd6069c529ac2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3572D83260DFC291EA71AB14E8913EBA3A4FBC4750F805576D68C83BA9DF2CD558CB10
                                                                                                                                                                                      Function 00007FF71ADC5A90 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 439COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ADC6279
                                                                                                                                                                                        • Part of subcall function 00007FF71AC37E60: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC37EF7
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsFac_nodeFac_node::_shared_ptrstd::_type_info::_name_internal_method
                                                                                                                                                                                      • String ID: ClassGuid$CompatID$Description$DevLoader$DeviceClass$DeviceID$DeviceName$DriverDate$DriverName$DriverProviderName$DriverVersion$FriendlyName$HardWareID$InfName$Location$Manufacturer$Name$PDO$Signer$StartMode$Status$SystemCreationClassName$SystemName
                                                                                                                                                                                      • API String ID: 2107158585-2483722238
                                                                                                                                                                                      • Opcode ID: 8c9dae2d0b4baddbd6e5993269c56f39160e1e475aa49e03e364bb986d9b97f7
                                                                                                                                                                                      • Instruction ID: 325595bd7fe8fe81f9ce495776694b73eb8b91db692e4f2c2153f993285fcd10
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c9dae2d0b4baddbd6e5993269c56f39160e1e475aa49e03e364bb986d9b97f7
                                                                                                                                                                                      • Instruction Fuzzy Hash: B832D03251EEC2A1EA70EB14E8912EEE360FBC5350F805577D68D83A69EE2CD54CCB10
                                                                                                                                                                                      Function 00007FF71ADA2C40 Relevance: 35.9, APIs: 10, Strings: 10, Instructions: 897COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 2202 7ff71ada2c40-7ff71ada3138 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf13f0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72420 call 7ff71abed210 call 7ff71ae09110 2289 7ff71ada313a-7ff71ada3149 2202->2289 2290 7ff71ada314b-7ff71ada3152 2202->2290 2291 7ff71ada315a-7ff71ada334d call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abfa530 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 * 2 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72420 call 7ff71abed210 call 7ff71ae09110 2289->2291 2290->2291 2324 7ff71ada334f-7ff71ada3357 2291->2324 2325 7ff71ada3359 2291->2325 2326 7ff71ada3361-7ff71ada34a5 call 7ff71abf3680 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72420 call 7ff71abed210 call 7ff71ae09110 2324->2326 2325->2326 2343 7ff71ada34b1 2326->2343 2344 7ff71ada34a7-7ff71ada34af 2326->2344 2345 7ff71ada34b9-7ff71ada35fd call 7ff71abf3680 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72420 call 7ff71abed210 call 7ff71ae09110 2343->2345 2344->2345 2362 7ff71ada35ff-7ff71ada3607 2345->2362 2363 7ff71ada3609 2345->2363 2364 7ff71ada3611-7ff71ada362c call 7ff71abf3680 2362->2364 2363->2364 2367 7ff71ada363f-7ff71ada3646 2364->2367 2368 7ff71ada362e-7ff71ada363d 2364->2368 2369 7ff71ada364e-7ff71ada370a call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abfa530 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 2367->2369 2368->2369 2386 7ff71ada370c-7ff71ada371b 2369->2386 2387 7ff71ada371d-7ff71ada3724 2369->2387 2388 7ff71ada372c-7ff71ada37e8 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abfa530 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 2386->2388 2387->2388 2405 7ff71ada37ea-7ff71ada37f9 2388->2405 2406 7ff71ada37fb-7ff71ada3802 2388->2406 2407 7ff71ada380a-7ff71ada38cc call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abfa530 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 2405->2407 2406->2407 2424 7ff71ada38d2-7ff71ada3aef call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 2407->2424 2425 7ff71ada3bf9-7ff71ada3d6e call 7ff71abf0c10 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac72310 call 7ff71abf54e0 call 7ff71abf52b0 call 7ff71ac10350 call 7ff71ac0a8b0 2407->2425 2504 7ff71ada3af1-7ff71ada3af6 2424->2504 2505 7ff71ada3af8 2424->2505 2466 7ff71ada3d74-7ff71ada3d9d call 7ff71ac0a8b0 2425->2466 2467 7ff71ada3e05-7ff71ada3e16 call 7ff71ac0a8b0 2425->2467 2477 7ff71ada3dac-7ff71ada3db9 2466->2477 2475 7ff71ada3f01-7ff71ada40c5 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abfa530 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf50c0 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf05d0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ada15d0 * 2 call 7ff71ada15a0 call 7ff71ada15d0 call 7ff71abe9ef0 call 7ff71ada15d0 call 7ff71abf3680 2467->2475 2476 7ff71ada3e1c-7ff71ada3f00 call 7ff71abebc20 call 7ff71ac05ce0 call 7ff71ac03140 call 7ff71abf5830 call 7ff71abe97a0 call 7ff71abf5040 call 7ff71abf3c10 2467->2476 2568 7ff71ada40d1 2475->2568 2569 7ff71ada40c7-7ff71ada40cf 2475->2569 2476->2475 2481 7ff71ada3e00 2477->2481 2482 7ff71ada3dbb-7ff71ada3dfe call 7ff71ac03140 call 7ff71ac09be0 2477->2482 2481->2475 2482->2477 2508 7ff71ada3afd-7ff71ada3b04 2504->2508 2505->2508 2511 7ff71ada3b06-7ff71ada3b15 2508->2511 2512 7ff71ada3b17-7ff71ada3b1e 2508->2512 2515 7ff71ada3b26-7ff71ada3bf8 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf56a0 call 7ff71abf5160 call 7ff71abf3c10 call 7ff71abf3680 call 7ff71abf3c10 * 2 2511->2515 2512->2515 2515->2425 2570 7ff71ada40d9-7ff71ada4202 call 7ff71ac926a0 call 7ff71abf0450 call 7ff71ac8db90 call 7ff71abf3680 call 7ff71abf3c10 call 7ff71abf7240 call 7ff71abf3d60 call 7ff71abf3c10 * 7 2568->2570 2569->2570
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72470
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: strrchr.LIBCMTD ref: 00007FF71AC72487
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegQueryValueExW.KERNEL32 ref: 00007FF71AC724D3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegCloseKey.KERNEL32 ref: 00007FF71AC724ED
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ADA31EF
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ADA36E3
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ADA37C1
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ADA3BBB
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ADA389F
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72347
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegQueryValueExW.KERNEL32 ref: 00007FF71AC72392
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.ADVAPI32 ref: 00007FF71AC723A1
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ADA4039
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ADA4048
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ADA4065
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ADA4074
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ADA4090
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: type_info::_name_internal_method$Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWork$CloseCreateQueryValue$Char_traitsshared_ptrstrrchr
                                                                                                                                                                                      • String ID: ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl$theme_parameter${"app" : {
                                                                                                                                                                                      • API String ID: 3722789660-4154301006
                                                                                                                                                                                      • Opcode ID: d1ec313ace76c82f8cc25c5cc675d78d701817aa0fb6644243634f21f02a5c37
                                                                                                                                                                                      • Instruction ID: 7dbba9c061a62fd173c28b7d6f3cd1c618436822e1792a0505846bfb24875f53
                                                                                                                                                                                      • Opcode Fuzzy Hash: d1ec313ace76c82f8cc25c5cc675d78d701817aa0fb6644243634f21f02a5c37
                                                                                                                                                                                      • Instruction Fuzzy Hash: 17B2C77660EFC294EAB0AB10F4902EBB3A4EBC5750F805176D68D83B59EF2CD558CB50
                                                                                                                                                                                      Function 00007FF71ABFC290 Relevance: 34.6, APIs: 6, Strings: 13, Instructions: 1383COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 2599 7ff71abfc290-7ff71abfc718 call 7ff71ae02f90 call 7ff71ac0a0d0 call 7ff71ac0d500 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf05d0 call 7ff71ac5a6b0 call 7ff71abed210 * 2 call 7ff71abfa250 call 7ff71abf3680 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71abe8ad0 call 7ff71ac048d0 call 7ff71abf8790 2680 7ff71abfc71e-7ff71abfc804 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03b30 call 7ff71abf3680 call 7ff71abf4e10 call 7ff71abf3680 * 2 call 7ff71abf3c10 call 7ff71abf3680 * 5 2599->2680 2681 7ff71abfc809-7ff71abfc818 call 7ff71ac72f10 call 7ff71ac0b220 2599->2681 2772 7ff71abfe29b-7ff71abfe2a2 2680->2772 2690 7ff71abfc819-7ff71abfc82c call 7ff71ac8e340 2681->2690 2696 7ff71abfca43-7ff71abfca6e call 7ff71ac0cdd0 call 7ff71ac097e0 call 7ff71ac0b220 2690->2696 2697 7ff71abfc832-7ff71abfc843 2690->2697 2718 7ff71abfca73-7ff71abfca86 call 7ff71ac8d2d0 2696->2718 2697->2696 2700 7ff71abfc849-7ff71abfc891 call 7ff71ac0b220 call 7ff71abea520 call 7ff71abe9a20 call 7ff71ac04400 2697->2700 2726 7ff71abfca11-7ff71abfca38 call 7ff71ac8d390 call 7ff71abf7d40 call 7ff71abefed0 2700->2726 2727 7ff71abfc897-7ff71abfca0c call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03340 call 7ff71abf3680 call 7ff71ac72f10 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03b30 call 7ff71abf3680 call 7ff71ac0bd30 call 7ff71abf4e10 call 7ff71abf3680 * 2 call 7ff71abf3c10 call 7ff71abf3680 * 5 2700->2727 2729 7ff71abfca8c-7ff71abfca9d 2718->2729 2730 7ff71abfcc8b-7ff71abfcf0d call 7ff71abf02f0 call 7ff71abe93b0 call 7ff71adcf450 call 7ff71adcf480 call 7ff71abf0510 * 3 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 5 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac8db90 2718->2730 2759 7ff71abfca3d-7ff71abfca3e 2726->2759 2727->2772 2729->2730 2735 7ff71abfcaa3-7ff71abfcaeb call 7ff71ac0b220 call 7ff71abea520 call 7ff71abe9a20 call 7ff71ac04400 2729->2735 2870 7ff71abfcf0f-7ff71abfcf78 call 7ff71abf4e10 call 7ff71abf3680 * 2 call 7ff71abf3c10 call 7ff71abf3680 * 5 2730->2870 2871 7ff71abfcf7d-7ff71abfd513 call 7ff71abed210 call 7ff71ac201e0 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 call 7ff71ac21a90 call 7ff71abebc20 call 7ff71acaa0c0 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71ac8a070 call 7ff71abebc20 call 7ff71acaa0c0 call 7ff71abf4730 call 7ff71abed210 call 7ff71ac8fd90 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71ac938c0 call 7ff71abebc20 call 7ff71acaa160 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71ac98be0 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 call 7ff71ac99bc0 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 call 7ff71ac9ff90 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71acaea80 call 7ff71abebc20 call 7ff71acaa160 call 7ff71abf4730 2730->2871 2773 7ff71abfcaf1-7ff71abfcc66 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03340 call 7ff71abf3680 call 7ff71ac72f10 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac03b30 call 7ff71abf3680 call 7ff71ac0bd30 call 7ff71abf4e10 call 7ff71abf3680 * 2 call 7ff71abf3c10 call 7ff71abf3680 * 5 2735->2773 2774 7ff71abfcc6b-7ff71abfcc86 call 7ff71abf7d40 call 7ff71abefed0 2735->2774 2759->2690 2773->2772 2774->2718 2870->2772 2995 7ff71abfd515-7ff71abfd523 call 7ff71ac09dd0 2871->2995 2996 7ff71abfd528-7ff71abfd574 call 7ff71abed210 * 2 call 7ff71ad9f510 2871->2996 3001 7ff71abfd5ca-7ff71abfd96d call 7ff71abed210 * 2 call 7ff71ad9cd30 call 7ff71abebc20 call 7ff71acaa0c0 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71ada4210 call 7ff71abebc20 call 7ff71acaa160 call 7ff71abf4730 call 7ff71abed210 * 2 call 7ff71adb2560 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 call 7ff71adb5180 call 7ff71abebc20 call 7ff71acaa2b0 call 7ff71abf4730 call 7ff71abed210 call 7ff71acaab80 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71adb3e60 call 7ff71abe8ad0 call 7ff71ac048d0 call 7ff71abe8ad0 2995->3001 3008 7ff71abfd579-7ff71abfd5c9 call 7ff71abebc20 call 7ff71acaa0c0 call 7ff71abf4730 2996->3008 3079 7ff71abfd972-7ff71abfda53 call 7ff71ac048d0 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71ac8db90 WaitForSingleObject call 7ff71adcf4d0 3001->3079 3008->3001 3090 7ff71abfe1a5-7ff71abfe1f8 call 7ff71ac8d420 call 7ff71ac72f10 call 7ff71ac062c0 ResetEvent 3079->3090 3091 7ff71abfda59-7ff71abfda75 WaitForSingleObject 3079->3091 3106 7ff71abfe1fa-7ff71abfe207 call 7ff71ac0bd30 3090->3106 3107 7ff71abfe208-7ff71abfe29a call 7ff71abf4e10 * 2 call 7ff71abf3c10 call 7ff71abf4e10 call 7ff71abf3680 * 2 call 7ff71abf3c10 call 7ff71abf3680 * 5 3090->3107 3093 7ff71abfe180-7ff71abfe1a4 CloseHandle * 2 3091->3093 3094 7ff71abfda7b-7ff71abfdd19 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf0510 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7cb80 call 7ff71ac9b750 3091->3094 3093->3090 3160 7ff71abfdf40-7ff71abfdf45 3094->3160 3161 7ff71abfdd1f-7ff71abfdf3b call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf0510 * 3 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 5 call 7ff71abf3c10 3094->3161 3106->3107 3107->2772 3163 7ff71abfdf4b-7ff71abfe166 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abed210 call 7ff71abf11a0 call 7ff71abf3680 call 7ff71abf0510 * 3 call 7ff71abf10b0 call 7ff71ac39220 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 5 call 7ff71abf3c10 3160->3163 3164 7ff71abfe167-7ff71abfe17f call 7ff71abf3c10 call 7ff71abf3680 3160->3164 3161->3164 3163->3164 3164->3093
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Cpp_errorDecorator::getNameTableThrow_Typestd::_$Char_traitsCloseDefaultFileLanguageLocaleModuleOpenThrd_detachUserValuetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: prnt=%ws&sys_lang=%ws$product$product$started$ui_closing_failed$ui_closing_timeout$ui_creation_error$ui_not_found$waiting_for_UI_connection$waiting_for_windows_creation$windows_created${"app" : {"show_window":"main"}}${"app": {"init": {"engineInit": true}}}
                                                                                                                                                                                      • API String ID: 2904651881-622979156
                                                                                                                                                                                      • Opcode ID: 4c81cb52663e0644b9a14b26d905f305048dabe68d93781b3eb82e6140724bc1
                                                                                                                                                                                      • Instruction ID: c2674f3328952e79dd754cb4a1a1f14482726178dde72b0109f8d58d6e4a020c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4c81cb52663e0644b9a14b26d905f305048dabe68d93781b3eb82e6140724bc1
                                                                                                                                                                                      • Instruction Fuzzy Hash: C1F2FD3250DEC291EA70AB14F8913EFA3A4FBC5750F801476D68D87BAADE2CD558CB50
                                                                                                                                                                                      Function 00007FF71ADA4210 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 477COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 3348 7ff71ada4210-7ff71ada4236 3349 7ff71ada4238-7ff71ada4245 3348->3349 3350 7ff71ada4247-7ff71ada4267 call 7ff71ac88880 3348->3350 3349->3350 3351 7ff71ada426c-7ff71ada4507 call 7ff71ada2c40 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 CreateEventW call 7ff71abf3680 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 3349->3351 3355 7ff71ada4e0b-7ff71ada4e12 3350->3355 3397 7ff71ada46e4-7ff71ada4cf9 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf02f0 call 7ff71ada0030 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ada0210 call 7ff71abf3680 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf02f0 call 7ff71ada0070 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ada0210 call 7ff71abf3680 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf02f0 call 7ff71ad9ffb0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ada0210 call 7ff71abf3680 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf02f0 call 7ff71ad9ff70 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ada0210 3351->3397 3398 7ff71ada450d-7ff71ada46e3 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf02f0 call 7ff71ad9fff0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ada0210 call 7ff71abf3680 * 3 3351->3398 3490 7ff71ada4cfe-7ff71ada4e03 call 7ff71abf3680 * 2 call 7ff71ac112e0 call 7ff71abf02f0 call 7ff71ad9feb0 call 7ff71ac887a0 call 7ff71abf4730 call 7ff71abf3680 * 8 3397->3490 3398->3397 3490->3355
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateEventW.KERNEL32 ref: 00007FF71ADA4324
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA45E7
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA0210: CreateEventW.KERNEL32 ref: 00007FF71ADA0238
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA477F
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA490F
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA4A9C
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA4C29
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ADA4D50
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9FEB0: shared_ptr.LIBCMTD ref: 00007FF71AD9FF23
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_SchedulerScheduler::_$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$CreateEvent$Char_traitstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: ClosingEvent$ColorPrevalence$ColorizationColor$EnableTransparency$Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Themes\Personalize$Software\Microsoft\Windows\DWM$SystemUsesLightTheme$TaskbarAl
                                                                                                                                                                                      • API String ID: 2878102572-2470191940
                                                                                                                                                                                      • Opcode ID: 52d916dba0fb7545d4e604d88e60b76319a522b152047a34d7a3f7404cfd839d
                                                                                                                                                                                      • Instruction ID: 47e4f4a23c395018f9387202d8943c3cf84c89211b5f070497d866409c29daf2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 52d916dba0fb7545d4e604d88e60b76319a522b152047a34d7a3f7404cfd839d
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC52A336609FC595EAB1AB15E8903DBB3A4FBC8790F804126DACC43B69DF2CD558CB50
                                                                                                                                                                                      Function 00007FF71AC9C300 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 111memoryCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Decorator::getTableType$QueryValue$Globalwsprintf$AllocFree
                                                                                                                                                                                      • String ID: \StringFileInfo\%04x%04x\FileDescription$\StringFileInfo\%04x%04x\ProductVersion$\VarFileInfo\Translation
                                                                                                                                                                                      • API String ID: 3623593157-227869778
                                                                                                                                                                                      • Opcode ID: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                      • Instruction ID: 480ef49a04f83eb84075cc212e2b4878ebecbdef01f297641e908d9bf6da93cd
                                                                                                                                                                                      • Opcode Fuzzy Hash: afe8b2dcc620858387f586322b9613184bd3ab54d5df8500ecc911c2893dbe4c
                                                                                                                                                                                      • Instruction Fuzzy Hash: CA514532618E8681EB60EB25E4517BAF360FBD4794F801173EA8D83669DF3CD549CB10
                                                                                                                                                                                      Function 00007FF71ADC0140 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 662COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 3552 7ff71adc0140-7ff71adc03b3 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71adbcaf0 call 7ff71ac788f0 call 7ff71ac19140 * 2 call 7ff71abf3be0 call 7ff71abf1680 call 7ff71adc7830 3592 7ff71adc03b8-7ff71adc04a2 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3552->3592 3609 7ff71adc0590-7ff71adc0679 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3592->3609 3610 7ff71adc04a8-7ff71adc058f call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7d20 call 7ff71ac19140 * 2 call 7ff71abf3be0 3592->3610 3643 7ff71adc067f-7ff71adc0766 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7d20 call 7ff71ac19140 * 2 call 7ff71abf3be0 3609->3643 3644 7ff71adc0767-7ff71adc07b2 call 7ff71ac02900 call 7ff71ac02950 3609->3644 3610->3609 3643->3644 3656 7ff71adc0a73-7ff71adc0a82 call 7ff71ac1f380 3644->3656 3657 7ff71adc07b8-7ff71adc08a8 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3644->3657 3664 7ff71adc0a88-7ff71adc109b call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71adbb4e0 call 7ff71ac53390 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71adbb760 call 7ff71ac1b5c0 call 7ff71adbb120 call 7ff71adc7e90 call 7ff71abf05d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71adb5480 call 7ff71ac1c650 call 7ff71ac031e0 call 7ff71abf04b0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 * 2 call 7ff71abf3be0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71ac191f0 call 7ff71abf3680 * 6 3656->3664 3665 7ff71adc109c-7ff71adc1112 call 7ff71adbc450 call 7ff71adbc430 call 7ff71ac19140 call 7ff71abf3be0 * 5 3656->3665 3715 7ff71adc0a6e 3657->3715 3716 7ff71adc08ae-7ff71adc0a6d call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7270 call 7ff71ac19140 * 2 call 7ff71abf3be0 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71ac1f420 call 7ff71adbb360 call 7ff71adbc430 3657->3716 3664->3665 3715->3656 3716->3715
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39B51
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39B8C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: shared_ptr.LIBCMTD ref: 00007FF71AC39BC8
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC395B3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC3963C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC78930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF71AC78982
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC789B2
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF71AC78A27
                                                                                                                                                                                        • Part of subcall function 00007FF71ADC7830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADC7944
                                                                                                                                                                                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF71ADC0779
                                                                                                                                                                                      • HandleT.LIBCPMTD ref: 00007FF71ADC0788
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: /p.gif$Default$Extensions$Guest Profile$Microsoft\Edge\User Data$Secure Preferences$data=%ws$ev.pcapp.store$ext_edge$pcdetails
                                                                                                                                                                                      • API String ID: 9541410-4110900778
                                                                                                                                                                                      • Opcode ID: 89073b8a891081ebd01b3e264ec873724895a4e05db49532dc06c59376d7f21c
                                                                                                                                                                                      • Instruction ID: 64e7d5db9c206caf3a98b9d81e6946b605939e514ff01bf3df63e9f375523d87
                                                                                                                                                                                      • Opcode Fuzzy Hash: 89073b8a891081ebd01b3e264ec873724895a4e05db49532dc06c59376d7f21c
                                                                                                                                                                                      • Instruction Fuzzy Hash: EC82D73260EEC695EAB0AB14E4902EFB364FBC5750F805136D6CD83B6ADE2CD549CB50
                                                                                                                                                                                      Function 00007FF71ADBF160 Relevance: 23.4, APIs: 3, Strings: 10, Instructions: 661COMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 3836 7ff71adbf160-7ff71adbf4c2 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0f30 call 7ff71ac39aa0 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71adbcaf0 call 7ff71ac788f0 call 7ff71ac19140 * 2 call 7ff71abf3be0 call 7ff71abf1680 call 7ff71adc7830 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3893 7ff71adbf5b0-7ff71adbf699 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3836->3893 3894 7ff71adbf4c8-7ff71adbf5af call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7d20 call 7ff71ac19140 * 2 call 7ff71abf3be0 3836->3894 3927 7ff71adbf69f-7ff71adbf786 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7d20 call 7ff71ac19140 * 2 call 7ff71abf3be0 3893->3927 3928 7ff71adbf787-7ff71adbf7d2 call 7ff71ac02900 call 7ff71ac02950 3893->3928 3894->3893 3927->3928 3940 7ff71adbfa93-7ff71adbfaa2 call 7ff71ac1f380 3928->3940 3941 7ff71adbf7d8-7ff71adbf8c8 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71ac6bf80 call 7ff71ac19140 * 2 call 7ff71abf3be0 3928->3941 3948 7ff71adbfaa8-7ff71adc00bb call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71adbb4e0 call 7ff71ac53390 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71adbb760 call 7ff71ac1b5c0 call 7ff71adbb120 call 7ff71adc7e90 call 7ff71abf05d0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71adb5480 call 7ff71ac1c650 call 7ff71ac031e0 call 7ff71abf04b0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abed210 call 7ff71abfa250 call 7ff71abf3680 * 2 call 7ff71abf3be0 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7ca30 call 7ff71abf3680 * 4 call 7ff71ac191f0 call 7ff71abf3680 * 6 3940->3948 3949 7ff71adc00bc-7ff71adc0132 call 7ff71adbc450 call 7ff71adbc430 call 7ff71ac19140 call 7ff71abf3be0 * 5 3940->3949 3999 7ff71adbfa8e 3941->3999 4000 7ff71adbf8ce-7ff71adbf983 call 7ff71abf0e90 call 7ff71ac39580 call 7ff71ac7f8f0 call 7ff71ac788f0 call 7ff71adc7270 3941->4000 3948->3949 3999->3940 4023 7ff71adbf988-7ff71adbfa8d call 7ff71ac19140 * 2 call 7ff71abf3be0 call 7ff71ac1f420 call 7ff71ac1b5c0 call 7ff71ac1f420 call 7ff71adbb360 call 7ff71adbc430 4000->4023 4023->3999
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39B51
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39B8C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: shared_ptr.LIBCMTD ref: 00007FF71AC39BC8
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC395B3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC3963C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC78930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF71AC78982
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC789B2
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788F0: std::_Is_slash_oper::operator.LIBCPMTD ref: 00007FF71AC78A27
                                                                                                                                                                                        • Part of subcall function 00007FF71ADC7830: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADC7944
                                                                                                                                                                                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF71ADBF799
                                                                                                                                                                                      • HandleT.LIBCPMTD ref: 00007FF71ADBF7A8
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Is_slash_oper::operatorstd::_$Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_char_traitstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: /p.gif$Default$Extensions$Google\Chrome\User Data$Guest Profile$Secure Preferences$data=%ws$ev.pcapp.store$ext_chrome$pcdetails
                                                                                                                                                                                      • API String ID: 9541410-2486191938
                                                                                                                                                                                      • Opcode ID: 7ce3f4fe280d75743a87b0798a097f6d10f88f99708686c7857d68effd4f3b3e
                                                                                                                                                                                      • Instruction ID: 12281e06e2e44fec79f8ec975363c5546a4214f476b7d2faf295f27258c4a148
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ce3f4fe280d75743a87b0798a097f6d10f88f99708686c7857d68effd4f3b3e
                                                                                                                                                                                      • Instruction Fuzzy Hash: CC82C83260EEC695EAB0AB14E4902EFB364FBC5750F805172D6CD83B6ADE2CD549CB50
                                                                                                                                                                                      Function 00007FF71AC3BE70 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 264timeCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 4120 7ff71ac3be70-7ff71ac3beab 4121 7ff71ac3beb1-7ff71ac3beca call 7ff71ac26b60 4120->4121 4122 7ff71ac3bf50-7ff71ac3bf52 4120->4122 4126 7ff71ac3becc-7ff71ac3bedf 4121->4126 4127 7ff71ac3bee1-7ff71ac3beed 4121->4127 4124 7ff71ac3c4c9-7ff71ac3c4d0 4122->4124 4128 7ff71ac3bef2-7ff71ac3bf5d call 7ff71abed210 WinHttpConnect 4126->4128 4127->4128 4132 7ff71ac3c449-7ff71ac3c44b 4128->4132 4133 7ff71ac3bf63-7ff71ac3c2bb call 7ff71abf05d0 GetTickCount64 call 7ff71ac26b60 4128->4133 4132->4124 4138 7ff71ac3c2dd-7ff71ac3c2f1 call 7ff71abed210 4133->4138 4139 7ff71ac3c2bd-7ff71ac3c2db call 7ff71abed210 4133->4139 4144 7ff71ac3c2f9-7ff71ac3c3cf call 7ff71abed210 call 7ff71abfa250 call 7ff71abed210 WinHttpOpenRequest 4138->4144 4139->4144 4151 7ff71ac3c43c-7ff71ac3c453 call 7ff71abf3680 4144->4151 4152 7ff71ac3c3d1-7ff71ac3c3f7 WinHttpSetTimeouts 4144->4152 4162 7ff71ac3c485-7ff71ac3c48a 4151->4162 4163 7ff71ac3c455-7ff71ac3c481 WinHttpSendRequest 4151->4163 4152->4151 4153 7ff71ac3c3f9-7ff71ac3c3ff 4152->4153 4155 7ff71ac3c40d-7ff71ac3c413 4153->4155 4156 7ff71ac3c401-7ff71ac3c40c WinHttpCloseHandle 4153->4156 4158 7ff71ac3c421-7ff71ac3c437 call 7ff71abf3680 4155->4158 4159 7ff71ac3c415-7ff71ac3c420 WinHttpCloseHandle 4155->4159 4156->4155 4158->4124 4159->4158 4165 7ff71ac3c49d-7ff71ac3c4a3 4162->4165 4166 7ff71ac3c48c-7ff71ac3c499 WinHttpReceiveResponse 4162->4166 4163->4162 4167 7ff71ac3c4b1-7ff71ac3c4b7 4165->4167 4168 7ff71ac3c4a5-7ff71ac3c4b0 WinHttpCloseHandle 4165->4168 4166->4165 4169 7ff71ac3c4b9-7ff71ac3c4c4 WinHttpCloseHandle 4167->4169 4170 7ff71ac3c4c5 4167->4170 4168->4167 4169->4170 4170->4124
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Http$CloseHandle$Requeststd::ios_base::good$ConnectCount64OpenReceiveResponseSendTickTimeouts
                                                                                                                                                                                      • String ID: GET
                                                                                                                                                                                      • API String ID: 2571818228-1805413626
                                                                                                                                                                                      • Opcode ID: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                      • Instruction ID: a10332f8f30709eebebcda52df435815407876870612ffade3c57c6acd4d3dc5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 97b424a5f142e7ff86e6a48141ea42eb383f2602b031ef10f70d93426b751497
                                                                                                                                                                                      • Instruction Fuzzy Hash: D7F1413660DFC585EAB09B56F8843AAB3A4F788794F504526DACD43B68DF7CD098CB10
                                                                                                                                                                                      Function 00007FF71ABFE340 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 302windowCOMMON
                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                      • Executed
                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                      control_flow_graph 4171 7ff71abfe340-7ff71abfe36a 4172 7ff71abfe395-7ff71abfe39d 4171->4172 4173 7ff71abfe36c-7ff71abfe371 4171->4173 4174 7ff71abfe425-7ff71abfe42e 4172->4174 4175 7ff71abfe3a3-7ff71abfe3ab 4172->4175 4176 7ff71abfe420 4173->4176 4177 7ff71abfe377-7ff71abfe37c 4173->4177 4181 7ff71abfe434-7ff71abfe6d8 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 8 4174->4181 4182 7ff71abfe6dd-7ff71abfe6e6 4174->4182 4178 7ff71abfe3b1 4175->4178 4179 7ff71abfe99b-7ff71abfe9a4 4175->4179 4180 7ff71abfe9ec-7ff71abfea0b DefWindowProcW 4176->4180 4183 7ff71abfe3b6 4177->4183 4184 7ff71abfe37e-7ff71abfe383 4177->4184 4188 7ff71abfe9c5-7ff71abfe9ea DefWindowProcW 4178->4188 4191 7ff71abfe9a6-7ff71abfe9af 4179->4191 4192 7ff71abfe9b8 4179->4192 4187 7ff71abfea11-7ff71abfea18 4180->4187 4190 7ff71abfe999 4181->4190 4189 7ff71abfe6ec-7ff71abfe998 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf11a0 call 7ff71ac398a0 call 7ff71abf0510 * 2 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71abf0450 call 7ff71ac38e90 call 7ff71ac7d350 call 7ff71abf3680 * 8 4182->4189 4182->4190 4183->4180 4185 7ff71abfe9ba-7ff71abfe9c3 PostQuitMessage 4184->4185 4186 7ff71abfe389-7ff71abfe38e 4184->4186 4185->4180 4194 7ff71abfe390 4186->4194 4195 7ff71abfe3bb-7ff71abfe3d1 4186->4195 4188->4187 4189->4190 4190->4180 4191->4192 4197 7ff71abfe9b1 4191->4197 4192->4180 4194->4188 4200 7ff71abfe3d3-7ff71abfe3ed PostMessageW 4195->4200 4201 7ff71abfe3ef-7ff71abfe3f8 4195->4201 4197->4192 4205 7ff71abfe414-7ff71abfe416 4200->4205 4201->4205 4206 7ff71abfe3fa-7ff71abfe413 PostMessageW 4201->4206 4205->4187 4206->4205
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessagePostProcWindow$Quit
                                                                                                                                                                                      • String ID: msg=resume_suspend$msg=suspend$product$product$system_event$system_event
                                                                                                                                                                                      • API String ID: 3552470998-2520652036
                                                                                                                                                                                      • Opcode ID: bb1eeb35814622bcfff6f56ad2811d5037266a6cfef8168e89c9ae4fc0cacff9
                                                                                                                                                                                      • Instruction ID: 5af368a8a2ac15a5e0984461efd1d3c6b73485536477f5315e9e2918ad85dca1
                                                                                                                                                                                      • Opcode Fuzzy Hash: bb1eeb35814622bcfff6f56ad2811d5037266a6cfef8168e89c9ae4fc0cacff9
                                                                                                                                                                                      • Instruction Fuzzy Hash: F5F1E53250DFC691EAB1AB14E8912EAF3A4FBC9750F805176D68D82B69DF3CD548CB10
                                                                                                                                                                                      Function 00007FF71ABF97D0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 439COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChildEnumWindows$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsClassNameTextWindowshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: =====> %ws FOUND <=====$Shell_TrayWnd$Start$TrayButton$TrayDummySearchControl
                                                                                                                                                                                      • API String ID: 1535316472-2840285642
                                                                                                                                                                                      • Opcode ID: 96ac9153ffd36a5883b0d46df32a48e1b158713675ea177da8c396b88063b6ab
                                                                                                                                                                                      • Instruction ID: f468c9bc4040bfe90afbf980599983828d6587da689968c0f8a6e126d968ed50
                                                                                                                                                                                      • Opcode Fuzzy Hash: 96ac9153ffd36a5883b0d46df32a48e1b158713675ea177da8c396b88063b6ab
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4F32EA3260EEC295EAB0EB10E4513EBF3A4FBC5750F844576D68D82AA9DF2CD548CB50
                                                                                                                                                                                      Function 00007FF71AC0A0D0 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 273COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC062C0: RegOpenKeyExW.KERNEL32 ref: 00007FF71AC0643E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC062C0: RegQueryValueExW.KERNEL32 ref: 00007FF71AC064F7
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC0A211
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC0A290
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC0A41F
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC0A31A
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Decorator::getTableType$shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsOpenQueryValuetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: RESTART$RUNNING$Unknown+state=%d$close_state=%ws$invalid_app_close$product
                                                                                                                                                                                      • API String ID: 3445494136-3736349495
                                                                                                                                                                                      • Opcode ID: 96f3449f2fe80e64fe5b2ff16487c83c7360cc7e42234520a3ddfa8060fcd227
                                                                                                                                                                                      • Instruction ID: 57c892b885a0f71b3a2b79f6b38c8fcfb70d9d196b526b5285bf7ac875b06273
                                                                                                                                                                                      • Opcode Fuzzy Hash: 96f3449f2fe80e64fe5b2ff16487c83c7360cc7e42234520a3ddfa8060fcd227
                                                                                                                                                                                      • Instruction Fuzzy Hash: ACE1C93250DEC2A5EA70AB14E8912EFF364FBC9350F805576D68D82B6ADF2CD558CB10
                                                                                                                                                                                      Function 00007FF71ACAB680 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 270comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0B220: _Subatomic.LIBCONCRTD ref: 00007FF71AC0B28E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • CoInitialize.OLE32 ref: 00007FF71ACABBAC
                                                                                                                                                                                      • CoCreateInstance.OLE32 ref: 00007FF71ACABBDD
                                                                                                                                                                                      • shared_ptr.LIBCMTD ref: 00007FF71ACABC13
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71ACAE0E0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF71ACAE15B
                                                                                                                                                                                        • Part of subcall function 00007FF71ACAE0E0: HandleT.LIBCPMTD ref: 00007FF71ACAE16A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CreateCriticalHandleInitializeInstanceLock::_ReentrantScoped_lockScoped_lock::~_Subatomictype_info::_name_internal_method
                                                                                                                                                                                      • String ID: SearchApp.exe$SearchHost.exe$SearchUI.exe$ShellExperienceHost.exe$StartMenuExperienceHost.exe$explorer.exe
                                                                                                                                                                                      • API String ID: 1408288539-3335880049
                                                                                                                                                                                      • Opcode ID: 512a224dd02ea1d0842bd63d1e2cdbcfaef8bd85595babb0ac4d4ddcf4e4bf79
                                                                                                                                                                                      • Instruction ID: 6ca14246948c6d99aaa0c3f694025ce5213c425741f0c4e4e30d312fe58ea82c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 512a224dd02ea1d0842bd63d1e2cdbcfaef8bd85595babb0ac4d4ddcf4e4bf79
                                                                                                                                                                                      • Instruction Fuzzy Hash: 72E1F536609FC691EAB0AB15E4943EAB360FBC5790F804472D68D83B69EF3CD548CB50
                                                                                                                                                                                      Function 00007FF71AD9CD30 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 242comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • CoCreateInstance.COMBASE ref: 00007FF71AD9D0B8
                                                                                                                                                                                        • Part of subcall function 00007FF71AD99560: SetLastError.KERNEL32 ref: 00007FF71AD99570
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF71AD9D0D2
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AD9D1C1
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$ErrorLast$Char_traitsConcurrency::details::_CreateInstanceSchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: CoCreateInstance+CLSID_AppVisibility+IID_IAppVisibility$CoInitialize+Init+Failed${"app" : {"hide_window": "menu_search"}}${"app" : {"hide_window": "menu_store"}}${"app" : {"menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}${"app" : {"show_window": "menu_store","menu_store" : {"top":%d,"left":%d,"bottom":%d,"right":%d}}}
                                                                                                                                                                                      • API String ID: 2502378382-2706694235
                                                                                                                                                                                      • Opcode ID: 52605cdba7c607fe7ef88e3be8f7c97ff5c2f6bf304fa391244b780dd285a1d7
                                                                                                                                                                                      • Instruction ID: 4c14a4ad575af00d6b098b76e45f932a5bed21964230a788c863c54c77d49b8f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 52605cdba7c607fe7ef88e3be8f7c97ff5c2f6bf304fa391244b780dd285a1d7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4CD1D732A19EC295EA71AB14E8913EBF3A4FBC5750F804572D68C83B69DF2CD548CB50
                                                                                                                                                                                      Function 00007FF71ADC7270 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 245COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ADB5DD0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADB5DED
                                                                                                                                                                                      • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF71ADC72E0
                                                                                                                                                                                      • std::runtime_error::runtime_error.LIBCPMTD ref: 00007FF71ADC737F
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF3480: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF3493
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      • Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF71ADC73E5
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39B51
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39B8C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: shared_ptr.LIBCMTD ref: 00007FF71AC39BC8
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC395B3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC3963C
                                                                                                                                                                                      • allocator.LIBCPMTD ref: 00007FF71ADC7667
                                                                                                                                                                                        • Part of subcall function 00007FF71AC788C0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AC788D8
                                                                                                                                                                                        • Part of subcall function 00007FF71ADBC630: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71ADBC655
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADC7733
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Schedulershared_ptr$ProcessorProxyRoot::Virtual$Affinity::operator!=Concurrency::details::_ExceptionFileHardwareHeaderRaiseScheduler::_allocatorchar_traitsstd::runtime_error::runtime_errortype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Could not open file for reading$extensions$settings
                                                                                                                                                                                      • API String ID: 486076642-1363464879
                                                                                                                                                                                      • Opcode ID: d47261f8bdb6e576a3a1ab271fefdb0ca3a6cb17cc62b086da0423dd86f740f6
                                                                                                                                                                                      • Instruction ID: 8e39dfbc479e8b6717dbaf6d7c6926273e5e04ed72ca9a2651ca3d5f1daf038b
                                                                                                                                                                                      • Opcode Fuzzy Hash: d47261f8bdb6e576a3a1ab271fefdb0ca3a6cb17cc62b086da0423dd86f740f6
                                                                                                                                                                                      • Instruction Fuzzy Hash: BCD1C83261DEC695EA70AB14E4913EBB364FBC4350F805172D6CD82A6AEF2CD549CB50
                                                                                                                                                                                      Function 00007FF71ABF16D0 Relevance: 13.1, APIs: 4, Strings: 3, Instructions: 827COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9E070: CoInitializeEx.COMBASE ref: 00007FF71AD9E0E0
                                                                                                                                                                                        • Part of subcall function 00007FF71AC18980: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AC1899A
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF1540: _Ptr_base.LIBCMTD ref: 00007FF71ABF154E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • CreateEventW.KERNEL32 ref: 00007FF71ABF1C48
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF97A0: GetDesktopWindow.USER32 ref: 00007FF71ABF97A9
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF97A0: EnumChildWindows.USER32 ref: 00007FF71ABF97BC
                                                                                                                                                                                      • CreateDirectoryW.KERNEL32 ref: 00007FF71ABF1DEF
                                                                                                                                                                                      • CreateEventW.KERNEL32 ref: 00007FF71ABF1EEC
                                                                                                                                                                                        • Part of subcall function 00007FF71AC8C0B0: OpenEventW.KERNEL32 ref: 00007FF71AC8C1D6
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF1F52
                                                                                                                                                                                        • Part of subcall function 00007FF71AE02BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71AE02C00
                                                                                                                                                                                        • Part of subcall function 00007FF71AE02BD0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF71AE02C06
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::CreateEmptyEventQueue::StructuredWork$Concurrency::cancel_current_task$Char_traitsChildConcurrency::details::_Decorator::getDesktopDirectoryEnumInitializeOpenPtr_baseSchedulerScheduler::_TableTypeWindowWindowsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: ClosingEvent$DEBUGSCREEN_EVENT$\download
                                                                                                                                                                                      • API String ID: 3598548489-3079862309
                                                                                                                                                                                      • Opcode ID: e6127353d3f87f51ee2c9ddb30cc551090245481b1da2301295967429273d285
                                                                                                                                                                                      • Instruction ID: 238a185826d7e4a8111d6bf17d917650b5870522e2dfaaded56b76187bc57d69
                                                                                                                                                                                      • Opcode Fuzzy Hash: e6127353d3f87f51ee2c9ddb30cc551090245481b1da2301295967429273d285
                                                                                                                                                                                      • Instruction Fuzzy Hash: 17A2FA32609FC581EA70EB19E8953EBA364FBC5791F401476DA8D47B9AEF3CC1488B10
                                                                                                                                                                                      Function 00007FF71AC66000 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72470
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: strrchr.LIBCMTD ref: 00007FF71AC72487
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegQueryValueExW.KERNEL32 ref: 00007FF71AC724D3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72420: RegCloseKey.KERNEL32 ref: 00007FF71AC724ED
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC6620E
                                                                                                                                                                                      • std::ios_base::good.LIBCPMTD ref: 00007FF71AC6622A
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72347
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegQueryValueExW.KERNEL32 ref: 00007FF71AC72392
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.ADVAPI32 ref: 00007FF71AC723A1
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$CloseCreateQueryValue$Char_traitsDecorator::getTableTypestd::ios_base::goodstrrchrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: %lu$BuildNumber$CurrentBuild$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                                                                                                                                                      • API String ID: 1851878312-1501554625
                                                                                                                                                                                      • Opcode ID: 6b19b540af43060d8dd662ad890c85a655bb02675f1ba6ee5321fdef38fba9ba
                                                                                                                                                                                      • Instruction ID: 53649dbbb5553434d01bed1f24846c7cfdffc693913ec3f77f1dc7ee3b2bd66c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b19b540af43060d8dd662ad890c85a655bb02675f1ba6ee5321fdef38fba9ba
                                                                                                                                                                                      • Instruction Fuzzy Hash: DFA1E63651DEC294EA70AB15E8903EBB3A4FBC9350F805176E6CD42BA9DF2CC548CB50
                                                                                                                                                                                      Function 00007FF71AC0D500 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32 ref: 00007FF71AC0D606
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • RegOpenKeyExW.KERNEL32 ref: 00007FF71AC0D681
                                                                                                                                                                                      • RegSetValueExW.KERNEL32 ref: 00007FF71AC0D6DA
                                                                                                                                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF71AC0D6FE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseFileModuleNameOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: PCAppStore$Software\PCAppStore$status
                                                                                                                                                                                      • API String ID: 2919119571-3586994989
                                                                                                                                                                                      • Opcode ID: 8c07ba1863e5246fbf6d2c274bed9d8401648ad524e48053169e323cf75c6b9a
                                                                                                                                                                                      • Instruction ID: ac1e80be3b36602854e3460ef9ecd1f8847e53027817b7f1801fd7884123bfde
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c07ba1863e5246fbf6d2c274bed9d8401648ad524e48053169e323cf75c6b9a
                                                                                                                                                                                      • Instruction Fuzzy Hash: F551F832619BC196EA70AB24E4913ABF7A4FBC5750F805136E68D83B69DF3CD548CB10
                                                                                                                                                                                      Function 00007FF71AD9E460 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 403COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71AD9E6D8
                                                                                                                                                                                      • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71AD9E7AE
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWork$Char_traitsshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Shell_TrayWnd$Taskbar
                                                                                                                                                                                      • API String ID: 2730265358-1897506974
                                                                                                                                                                                      • Opcode ID: 81b131afe4b4b9db11478afcf97be4820d21c81ec199da8be23d8d1b2b16a985
                                                                                                                                                                                      • Instruction ID: c810a37ab182cff026d5acfb363096536ae5516401ab5e366202ea24b27fc84c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 81b131afe4b4b9db11478afcf97be4820d21c81ec199da8be23d8d1b2b16a985
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1122C43261DEC595EA70EB15E4912EAB3A0FBC4750F805572E6CD83BAADF2CD548CB10
                                                                                                                                                                                      Function 00007FF71AE25434 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 619889af01384461d7e5319121ca9095a97c8a0a174367da9f4bb2fb49f97b49
                                                                                                                                                                                      • Instruction ID: c8ade8adc2c31ba0f418a5b45f1a5f64ae8cce6b742cd1ff15620e7cfa7a3ef9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 619889af01384461d7e5319121ca9095a97c8a0a174367da9f4bb2fb49f97b49
                                                                                                                                                                                      • Instruction Fuzzy Hash: DFC1D522A0CF8681F750BB2596522BFA761EB80BA0F95417BD94F43391DE7DE84D8730
                                                                                                                                                                                      Function 00007FF71AC72F10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 32windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$MetricsSystem
                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                      • API String ID: 2388057244-4108050209
                                                                                                                                                                                      • Opcode ID: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                      • Instruction ID: c37a6e54a7d43fb8c8e23f8738f77242f5e803ca4c62fddfd91c1c2dc0752196
                                                                                                                                                                                      • Opcode Fuzzy Hash: cca869797438b31eb8facd3317cb589d6587005e4eef270a41aee582d9d839c9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 11012C726186448BE724AF30E05936BB7A5F788744F80523AE68E42B88DF7DC10CCF10
                                                                                                                                                                                      Function 00007FF71AC9BBA0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                      • Instruction ID: 103af73f251dec2b8bdce525c357b037fa6f85772e5b1925dc49d09977a482aa
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4cc3fc690caf46b215ce346ccdf43ddad07f5910bdaaf1cb7ebd7b0cc30fae4f
                                                                                                                                                                                      • Instruction Fuzzy Hash: B1C10C3260DEC195EA60EB15E4413EAF3A0FBC5760F804176E68D87BA9EE7CD548CB10
                                                                                                                                                                                      Function 00007FF71AC062C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • RegOpenKeyExW.KERNEL32 ref: 00007FF71AC0643E
                                                                                                                                                                                      • RegQueryValueExW.KERNEL32 ref: 00007FF71AC064F7
                                                                                                                                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF71AC06523
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseOpenQueryValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Software\PCAppStore$status
                                                                                                                                                                                      • API String ID: 2952970082-3794422696
                                                                                                                                                                                      • Opcode ID: 84e9c0cefb04e5e931d12d0b0afacc218c07190cc09768c308ffac17e090b7df
                                                                                                                                                                                      • Instruction ID: 2ad35996f661bbfce0c14189b373a923112d3e1bb3bb7de66525fb66c9b86e25
                                                                                                                                                                                      • Opcode Fuzzy Hash: 84e9c0cefb04e5e931d12d0b0afacc218c07190cc09768c308ffac17e090b7df
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8F61D232619AC295EA70AB14F4913ABB3A4FBC5790F805136E68D83B69DF3CD548CB50
                                                                                                                                                                                      Function 00007FF71ACAAB80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • OpenEventW.KERNEL32 ref: 00007FF71ACAAC42
                                                                                                                                                                                      • shared_ptr.LIBCMTD ref: 00007FF71ACAACFD
                                                                                                                                                                                      • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71ACAAD10
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ACAAD5E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$Affinity::operator!=Char_traitsEventFac_nodeFac_node::_HardwareOpenstd::_type_info::_name_internal_method
                                                                                                                                                                                      • String ID: DEBUGSCREEN_EVENT
                                                                                                                                                                                      • API String ID: 4219698036-491765807
                                                                                                                                                                                      • Opcode ID: ff124d5c9f6e1eac83997ed2123cc2d87d5af408ee2fe744dbebd0710b92456c
                                                                                                                                                                                      • Instruction ID: b75e8714bbd4f7febdbb32452ce7c367552302cfbd0c49944e6ade1ae97b8135
                                                                                                                                                                                      • Opcode Fuzzy Hash: ff124d5c9f6e1eac83997ed2123cc2d87d5af408ee2fe744dbebd0710b92456c
                                                                                                                                                                                      • Instruction Fuzzy Hash: DF51F93261DEC691EA70EB15E4913EBE360FBC5790F804472E68D47B6AEE2CD508CB50
                                                                                                                                                                                      Function 00007FF71AE0FC38 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2067211477-0
                                                                                                                                                                                      • Opcode ID: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                      • Instruction ID: f23ad4e5517120938cbca37d343d59bad8fd3de6451f1194e01942f4e43a4f93
                                                                                                                                                                                      • Opcode Fuzzy Hash: 98fd7ff7b0ded043c1c8bd62d9dc79a70e5c77a2b738dab7989ce3feaa60c173
                                                                                                                                                                                      • Instruction Fuzzy Hash: 54219D35B09F4282FE14BF65A55217BE3A4AF84BA0F880572DE4D43755DF3CE41C8624
                                                                                                                                                                                      Function 00007FF71AC0CDD0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 273COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0CFDE
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72347
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegQueryValueExW.KERNEL32 ref: 00007FF71AC72392
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.ADVAPI32 ref: 00007FF71AC723A1
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • widgetInfo, xrefs: 00007FF71AC0D19B
                                                                                                                                                                                      • {"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws, xrefs: 00007FF71AC0CE1B
                                                                                                                                                                                      • {"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}, xrefs: 00007FF71AC0D30B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsCloseCreateQueryValuetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: widgetInfo${"app" : { "init" : {"guid":"%ws","cache_folder_path":"%ws", "engine_version":"%ws", "windows_version":"%ws", "locale_layout":"%ws${"app": {"widget":{"savedPosition": {"x": %d, "y": %d}}}}
                                                                                                                                                                                      • API String ID: 2877627145-1185860185
                                                                                                                                                                                      • Opcode ID: 5a4755a20ddd2434bc3ea1c256145fdbd0676f0c5c310f67c044098d32f11ff4
                                                                                                                                                                                      • Instruction ID: ead0e94239bf2e5996c7b6870f0632980f7b8ac97ffbc42f413ed42f6756e2e0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5a4755a20ddd2434bc3ea1c256145fdbd0676f0c5c310f67c044098d32f11ff4
                                                                                                                                                                                      • Instruction Fuzzy Hash: 09F17436609FC595EAB1AB15E8803DBB3A4FBC9790F404126DACC83B69DF38C558CB40
                                                                                                                                                                                      Function 00007FF71AC389D0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                      • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF71AC38B79
                                                                                                                                                                                      • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF71AC38CB7
                                                                                                                                                                                      • Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF71AC38CDF
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF71AC389EE
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::task_continuation_context::task_continuation_context$char_traits
                                                                                                                                                                                      • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
                                                                                                                                                                                      • API String ID: 3112460731-1713319389
                                                                                                                                                                                      • Opcode ID: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                      • Instruction ID: f04ef5f010a1b3d5f18d958736c97dd5fb040dd691c23a739fb61c107de5f2b1
                                                                                                                                                                                      • Opcode Fuzzy Hash: b7a086962086a4a3b8ff3ea580c156ee40cde518962ec9efe31518dd0ce3de4f
                                                                                                                                                                                      • Instruction Fuzzy Hash: D0914D62618A5186E724DF18E45633AF2A0FBC8718F541236E7CE87BA9DB3CD945CF10
                                                                                                                                                                                      Function 00007FF71AD9F510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: 2${"app": {"init":{"direction":"%c","screen_size":{"with_topbar":%d,"t":%d,"l":%d,"b":%d,"r":%d}}}}
                                                                                                                                                                                      • API String ID: 3472098950-2542400605
                                                                                                                                                                                      • Opcode ID: 1cfdeb58fddc230b52cd1839f55015dbcc24deb05158eb2a1b7893df55390d0b
                                                                                                                                                                                      • Instruction ID: 2753ebca8259bef1f45bd11d713fc7f69f19777d86ac3341dc1212499fcfbb95
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1cfdeb58fddc230b52cd1839f55015dbcc24deb05158eb2a1b7893df55390d0b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9491A476609BC596EA70DB59F48439AB7A0F7C9B90F404126DA8D87B6ADF3CD444CF00
                                                                                                                                                                                      Function 00007FF71ADB2560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 130COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                      • String ID: 0u${"app": {"topbar": { "fullScreenMode": %d }}}${"app": {"topbar": { "rBinStatus": %d }}}
                                                                                                                                                                                      • API String ID: 2780765137-351494797
                                                                                                                                                                                      • Opcode ID: 6df33481c1ddcfb1fc45239aced8b78e07d62e926052ad770a3223e711b20cd8
                                                                                                                                                                                      • Instruction ID: 893b93479dcec88e60b488d7590c11ba78c6e8da5d47abb252d6990d6bb0d5eb
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6df33481c1ddcfb1fc45239aced8b78e07d62e926052ad770a3223e711b20cd8
                                                                                                                                                                                      • Instruction Fuzzy Hash: E161C432619FC295EA70AB15E4813ABB760FBC5790F805126EA8D43B6ADF3CD548CB50
                                                                                                                                                                                      Function 00007FF71ADA0E70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseConcurrency::scheduler_worker_creation_error::scheduler_worker_creation_errorOpen
                                                                                                                                                                                      • String ID: registry was not opened
                                                                                                                                                                                      • API String ID: 151454242-1342567452
                                                                                                                                                                                      • Opcode ID: 9c6a30821f39cca4299b5f1c744052f9267860183ccc1438cc387b8d23c73164
                                                                                                                                                                                      • Instruction ID: 18c78d2518785a393f2124fe8d4eec4692110b0f21beccc73b494bb70aa793d9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c6a30821f39cca4299b5f1c744052f9267860183ccc1438cc387b8d23c73164
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0C51D532619FC585EA70AB15F4913AAA3A0FBC5790F805436EACD83B69DF3CD558CB10
                                                                                                                                                                                      Function 00007FF71AD9F970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: System$Metrics$FromInfoMonitorParametersPoint
                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                      • API String ID: 865970660-3887548279
                                                                                                                                                                                      • Opcode ID: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
                                                                                                                                                                                      • Instruction ID: 3f791768510c0cb8403baa1f150cf0d1d207fbf03016cb66691cacd260f4eb81
                                                                                                                                                                                      • Opcode Fuzzy Hash: 13e12977f7533f15ef69eddcbbfc0fd0c8348206ac9712c3fd55c20fe7d31477
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D31543290CE8586E355AF25A05056EFBA1EB88BA4F4481B6D68D83759CB3CD6498F10
                                                                                                                                                                                      Function 00007FF71ABFAFB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62synchronizationCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • OpenEventW.KERNEL32 ref: 00007FF71ABFB069
                                                                                                                                                                                      • WaitForSingleObject.KERNEL32 ref: 00007FF71ABFB094
                                                                                                                                                                                      • CloseHandle.KERNEL32 ref: 00007FF71ABFB0B5
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsCloseEventHandleObjectOpenSingleWaitshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: ClosingEvent
                                                                                                                                                                                      • API String ID: 4183184898-2998232585
                                                                                                                                                                                      • Opcode ID: 09656c24b252a45f831180756a2fcbf0b27cf37362b50ca38d14d664f0709d84
                                                                                                                                                                                      • Instruction ID: 555eae5475f60b36cffe6f7d1dfb40a82473c749cabc1e75e90ae5e87c990576
                                                                                                                                                                                      • Opcode Fuzzy Hash: 09656c24b252a45f831180756a2fcbf0b27cf37362b50ca38d14d664f0709d84
                                                                                                                                                                                      • Instruction Fuzzy Hash: 54314E3290DE8292F660BB25E4412ABF7A1FBC5390F904476E68D82B79DE3CD549CB10
                                                                                                                                                                                      Function 00007FF71AE26984 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF71AE33181), ref: 00007FF71AE26AA0
                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FF71AE33181), ref: 00007FF71AE26B2B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                      • Opcode ID: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
                                                                                                                                                                                      • Instruction ID: b3cd96a417b3d7cea1fcf33fc49838ba2775768439883f2a80f5ce1cff814807
                                                                                                                                                                                      • Opcode Fuzzy Hash: c036e56a59628b86c18341a9c02e7de676271cae1522afdd6599a2391acaaf31
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E91D772F08E5185F750FF65944227EABA0EB407A8F94427FDE0E56694DE38D44DCB20
                                                                                                                                                                                      Function 00007FF71AC398A0 Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC389D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00007FF71AC38B79
                                                                                                                                                                                      • shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC37D60: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC37D7A
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::task_continuation_context::task_continuation_contextDecorator::getTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4040233825-0
                                                                                                                                                                                      • Opcode ID: 999ec43c9aae027c6b44944a69e8cab5925fd8519cf463550d9071242d999f88
                                                                                                                                                                                      • Instruction ID: 94f772bccdc10bc7454a2dc9b5e9289f9a4ff11a13579e9ba14bad5142e16b10
                                                                                                                                                                                      • Opcode Fuzzy Hash: 999ec43c9aae027c6b44944a69e8cab5925fd8519cf463550d9071242d999f88
                                                                                                                                                                                      • Instruction Fuzzy Hash: DA41FA3291DE8691EA30FB15E4513EBE760FBC4790F801573E68D83AAADE2CD548CB50
                                                                                                                                                                                      Function 00007FF71AC3B0C0 Relevance: 6.1, APIs: 4, Instructions: 78synchronizationCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$ObjectSingleWait
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 282557418-0
                                                                                                                                                                                      • Opcode ID: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                      • Instruction ID: 959280f07c0dde45595cf7324f06cf871fd00c0accd853513eabf54690fcc8c1
                                                                                                                                                                                      • Opcode Fuzzy Hash: e84f3ad846ed64f9196f56f3fe06c159fe096eb6db7144feb365fa05972e167c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E314E61E08A4683FE20FF29E44527EA390FF81794FD00576EA8D477A6DE2CD40A8B14
                                                                                                                                                                                      Function 00007FF71AC72420 Relevance: 6.1, APIs: 4, Instructions: 74registrystringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CloseCreateQueryValuestrrchr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2429320508-0
                                                                                                                                                                                      • Opcode ID: 76fa24b71c15b36789d78dfe259b308aabc8ae5bfbc31dd26dfb7016beec5fd7
                                                                                                                                                                                      • Instruction ID: 28086f24ec6f1fa3153e9ce7c1158be08c3959444e1133ddcb5d754fc7536d0d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 76fa24b71c15b36789d78dfe259b308aabc8ae5bfbc31dd26dfb7016beec5fd7
                                                                                                                                                                                      • Instruction Fuzzy Hash: BC31ED3251DEC192EA60EF25E8512ABF370FBC47A0F905576E68D83A69DF3CD4088B50
                                                                                                                                                                                      Function 00007FF71AC8F480 Relevance: 6.1, APIs: 4, Instructions: 60comfileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateInitialize$FileIcmpInstanceSecurity
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 897544864-0
                                                                                                                                                                                      • Opcode ID: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                      • Instruction ID: 01cbf365507154ea21e0ba50d49767f2ae9fbab05dcb17a16854cbae85c6c4db
                                                                                                                                                                                      • Opcode Fuzzy Hash: e4a8fba4a3a2cf6652689b814b655aac69ce770b39fc8cbd7eb8e22504de9c34
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3F311075A08F8982EB10EF2AE45535FB761FB81B64F504276EA9D077A5CF3DD0088B40
                                                                                                                                                                                      Function 00007FF71AC72310 Relevance: 6.1, APIs: 4, Instructions: 58registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Close$CreateQueryValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2495337196-0
                                                                                                                                                                                      • Opcode ID: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                      • Instruction ID: 7e447cad6d05f49ce29fb3cba75ad0df77fbfb7850b2eb74e1f262978266f93c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 560ce2b6002fda1f48c0e2119564795e5af3fb434074bb728d858a953253bbc0
                                                                                                                                                                                      • Instruction Fuzzy Hash: D121EB3252DE8182EA60EB26F85116FB7A5FBC5790F501076FACE47A69CF3CD4488B50
                                                                                                                                                                                      Function 00007FF71AC725A0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RegCreateKeyW.ADVAPI32 ref: 00007FF71AC725CE
                                                                                                                                                                                      • RegSetValueExW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71AC0F86D), ref: 00007FF71AC7261A
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71AC0F86D), ref: 00007FF71AC72629
                                                                                                                                                                                      • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF71AC0F86D), ref: 00007FF71AC72657
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Close$CreateValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1009429713-0
                                                                                                                                                                                      • Opcode ID: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                      • Instruction ID: a17d821e844869c60989f9248fc4a244a5a9b4cec5323e98e2b7aeaf4e715933
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7276f55dccbbdba195227a01b48dd228f0e69ce8f0cf39afd03d7a8aeece0958
                                                                                                                                                                                      • Instruction Fuzzy Hash: D121FF2251DE8181EA60BB26E85122FFB61FBD5790F501076F6DE47A69CF3CD4088B50
                                                                                                                                                                                      Function 00007FF71ADA22D0 Relevance: 6.0, APIs: 4, Instructions: 45registrywindowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChangeCloseDecorator::getExceptionFileFormatHeaderMessageNotifyRaiseTableTypeValuestd::bad_exception::bad_exception
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 364703902-0
                                                                                                                                                                                      • Opcode ID: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                      • Instruction ID: 125a996efd96fe94292876f51bd7e8e5d9ad49db27586669a9504e344c7d375c
                                                                                                                                                                                      • Opcode Fuzzy Hash: eb16407a55bedfc082493dc2b5cacc50af7eef1171e8d3171c4d170d14618321
                                                                                                                                                                                      • Instruction Fuzzy Hash: FB215C32618E8182E720EB21E45435AF7A0F7C5798F808036E68C43BA8DF7DD54CCB00
                                                                                                                                                                                      Function 00007FF71AC9B750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF71AC9B826
                                                                                                                                                                                      • HandleT.LIBCPMTD ref: 00007FF71AC9B835
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9B6E0: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF71AC9B882), ref: 00007FF71AC9B709
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_CriticalHandleLock::_OpenProcessReentrantScoped_lockScoped_lock::~_type_info::_name_internal_method
                                                                                                                                                                                      • String ID: NW_store.exe
                                                                                                                                                                                      • API String ID: 131083509-3827304589
                                                                                                                                                                                      • Opcode ID: 0eb572eeda2b3971b06023652c1247ef0e523a3e94787fdddf1dbb6735fbf637
                                                                                                                                                                                      • Instruction ID: 0f7eff97b294ece4ace412e33f0d686c1a07a083a4777d799ce94522eb7b43f1
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0eb572eeda2b3971b06023652c1247ef0e523a3e94787fdddf1dbb6735fbf637
                                                                                                                                                                                      • Instruction Fuzzy Hash: D541CB3250DE8195EA60AF15E4403AAF7A0FBC8794F900176E6CD47B69EF3CD558CB50
                                                                                                                                                                                      Function 00007FF71AC3AF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63timeCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • WinHttpOpen.WINHTTP ref: 00007FF71AC3B00E
                                                                                                                                                                                      • WinHttpSetTimeouts.WINHTTP ref: 00007FF71AC3B080
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyHttpQueue::StructuredWork$Char_traitsOpenTimeoutstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: WinHTTP 1.0
                                                                                                                                                                                      • API String ID: 2528808869-2851767304
                                                                                                                                                                                      • Opcode ID: ab6487053a0bb9ba6f99b1c97e2cbd6a778ce4020c98049a636e6a71f84992e2
                                                                                                                                                                                      • Instruction ID: 1984e4ed82aff8b823026b04d845cd311f5be695d36a0015a2044af83136fa80
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab6487053a0bb9ba6f99b1c97e2cbd6a778ce4020c98049a636e6a71f84992e2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0B311D32A1DA8196EA60EF15E44036BB7A0FFC0750F805076E68D47BA9DF7CD448CB50
                                                                                                                                                                                      Function 00007FF71AC38E90 Relevance: 4.7, APIs: 3, Instructions: 168COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Decorator::getTableType$shared_ptr$Char_traitsConcurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 43780872-0
                                                                                                                                                                                      • Opcode ID: 8ac78eafb021bbb44517f0da0aa74a89de45152ac752eac235ef43983bd2db08
                                                                                                                                                                                      • Instruction ID: 3b3e0efb606d5db1ee37e01c1a26f15d95efe88569cedf34042ca8760bd46795
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ac78eafb021bbb44517f0da0aa74a89de45152ac752eac235ef43983bd2db08
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5081D83261DEC691EA70EB15E4913EAA360FBC4794F805433E68D87B6ADF2CD548CB50
                                                                                                                                                                                      Function 00007FF71ADE4E5C Relevance: 4.6, APIs: 3, Instructions: 95COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2115809835-0
                                                                                                                                                                                      • Opcode ID: 884059259a7ae9d84c4e346144cf8cb6122bea1736f0bb3a1a37e3dc46d3a365
                                                                                                                                                                                      • Instruction ID: 8e2b00bad477d3dcf4c64493e1291a8da1d20ce8a199e0392242a1e7f5b375a8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 884059259a7ae9d84c4e346144cf8cb6122bea1736f0bb3a1a37e3dc46d3a365
                                                                                                                                                                                      • Instruction Fuzzy Hash: 06418E36608F8981EB18EB21E48026DA360FB98FD4F8444B2DE8D57B69DE3CD859C350
                                                                                                                                                                                      Function 00007FF71ABEB440 Relevance: 4.6, APIs: 3, Instructions: 91COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traits$Max_valueMin_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2926028262-0
                                                                                                                                                                                      • Opcode ID: 118083f3ed4fa9eb353dac5d35b43447e70ed818674fd26bc6b586135e149d56
                                                                                                                                                                                      • Instruction ID: 1996382b800f0482c5fca4dd1c74344e7494f878cf3f7590730d0c65cbd93e6f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 118083f3ed4fa9eb353dac5d35b43447e70ed818674fd26bc6b586135e149d56
                                                                                                                                                                                      • Instruction Fuzzy Hash: E7413B3661DF8681EA20EB25F09106EE7A0FBC9BA4F501136FA8D43B69DE3CD504CB50
                                                                                                                                                                                      Function 00007FF71ABEB5D0 Relevance: 4.6, APIs: 3, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traits$Max_valueMin_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2926028262-0
                                                                                                                                                                                      • Opcode ID: 606b80f16098f8636f21f7c2da3a3c04479a719d6c18abde3d7af2c065ddea84
                                                                                                                                                                                      • Instruction ID: 2833075963e5fddaa7d4ff6da14fac177ab5c585e67d5962d74266198401d8cb
                                                                                                                                                                                      • Opcode Fuzzy Hash: 606b80f16098f8636f21f7c2da3a3c04479a719d6c18abde3d7af2c065ddea84
                                                                                                                                                                                      • Instruction Fuzzy Hash: DF411C3661DF8281EA20EB15F05016EE7A1FBC9794F501176FA8D43B6ACE3CD5048B50
                                                                                                                                                                                      Function 00007FF71AC843D0 Relevance: 4.6, APIs: 3, Instructions: 79COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC843F2
                                                                                                                                                                                        • Part of subcall function 00007FF71AC65CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC65CF1
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC84475
                                                                                                                                                                                      • _Bitmask_includes.LIBCPMTD ref: 00007FF71AC844DC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Bitmask_includes
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2390111963-0
                                                                                                                                                                                      • Opcode ID: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                      • Instruction ID: d03797f171b8bbc918793994a9916c5e80a5dd7089f333d1025da39a8abd94f9
                                                                                                                                                                                      • Opcode Fuzzy Hash: a83db4324a4abcfd552098a8bf7e40096f33cd78f084c4a2e058ad9279e2f5f2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B410D31A0C98685FA20EF15E0413AEF3A0FBC5794F800176E68E87A9ADF3CD549CB50
                                                                                                                                                                                      Function 00007FF71ADC7830 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADC7944
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71ADBB680: _Idl_distance.LIBCPMTD ref: 00007FF71ADBB6CF
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39B51
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39B8C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: shared_ptr.LIBCMTD ref: 00007FF71AC39BC8
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC395B3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC3963C
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Idl_distancechar_traitstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: profile
                                                                                                                                                                                      • API String ID: 4115068943-2170006031
                                                                                                                                                                                      • Opcode ID: 206b2b28b3a3031e9816bd32708beaee2280e602c7619898a0b84833e2b57f47
                                                                                                                                                                                      • Instruction ID: 33d80ce16ae8480c48e6a9425c8bb94508d96ec4de5490a96d21c9044862cb9f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 206b2b28b3a3031e9816bd32708beaee2280e602c7619898a0b84833e2b57f47
                                                                                                                                                                                      • Instruction Fuzzy Hash: ED91EA3251DEC695EA70AB15E4913EBF360FBC4390F805076E6CD43AAADE2CD548CB50
                                                                                                                                                                                      Function 00007FF71AC59C90 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52processCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateProcessstrrchr
                                                                                                                                                                                      • String ID: h
                                                                                                                                                                                      • API String ID: 4037516736-2439710439
                                                                                                                                                                                      • Opcode ID: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                      • Instruction ID: 11d390f109a0dd583074b013f9dcd2606d22959c5c5cc456d81e8fb7cc827883
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b4d67693e087f15374fe2cb39532bd0f8a7dd7e7352cbe55a5af5981feb850d
                                                                                                                                                                                      • Instruction Fuzzy Hash: D1211532618A8282E760EB54E4903AFF7A0FBD0354F904036E68C47AA9DFBCD518CF40
                                                                                                                                                                                      Function 00007FF71AE16858 Relevance: 3.1, APIs: 2, Instructions: 132COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                      • Instruction ID: d3f77d7f1c9b29677841829a6b7ba1944e38393d36413c82ab4b39042d7cac42
                                                                                                                                                                                      • Opcode Fuzzy Hash: e880bca60e20fa46b069a9fa51f681df6431c92be232c2e0220b988f896fe569
                                                                                                                                                                                      • Instruction Fuzzy Hash: 74512732909A4187FA68BB28964227BB3A0EB15774F940177D69F87791CF6CE40EC770
                                                                                                                                                                                      Function 00007FF71AE1689C Relevance: 3.1, APIs: 2, Instructions: 77COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                      • Instruction ID: 07d75a0d5fa0ea80c2bd4d5030fbc994dae2b51597abcf8247033b9964fc707f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a5b8f90e18411c57f8b0fba21bd4e9db6e17063562557f0c65fbbde9f2cf7de
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D31B172A18E5682FA50FB24D4521BBA361EB94BA4FD501B2E51D473D2EF3CE10CCB20
                                                                                                                                                                                      Function 00007FF71ACAE0E0 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1248567937-0
                                                                                                                                                                                      • Opcode ID: 390d27b346eefd5e373e6541c632d24aac2aaa14e67103a187730549d5e0ef06
                                                                                                                                                                                      • Instruction ID: 2183cf6588c1610c24255f0b308f9a94ca78c146b0066a6c361be9061430323f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 390d27b346eefd5e373e6541c632d24aac2aaa14e67103a187730549d5e0ef06
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0D313E7251CE9691EA20EB15E4402AEE7A0FBC5794F901472E7CD43B6ADF7CD508CB50
                                                                                                                                                                                      Function 00007FF71ADA23C0 Relevance: 3.1, APIs: 2, Instructions: 57registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: QueryValue
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3660427363-0
                                                                                                                                                                                      • Opcode ID: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                      • Instruction ID: bc4095d7040809af3a3392f812f1c6fdec07ee18e9ea6ae3e751120979746e6d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8255e4681818947f7ead3aea93db6fb5ee972568b12f96a755b376553cfc7fd9
                                                                                                                                                                                      • Instruction Fuzzy Hash: D5211C32629F8583EA609B15E48461AB3E4FB85B90F901176FACD03B38DF7CC448CB10
                                                                                                                                                                                      Function 00007FF71AC9C8F0 Relevance: 3.1, APIs: 2, Instructions: 57COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1248567937-0
                                                                                                                                                                                      • Opcode ID: ce55fdf648d57d359128e6b136c20f195132b49a2ee17734789cddced627295c
                                                                                                                                                                                      • Instruction ID: c1df6b211caa20c31f36d8cce678855f1896a949e45df128f22664645519d61c
                                                                                                                                                                                      • Opcode Fuzzy Hash: ce55fdf648d57d359128e6b136c20f195132b49a2ee17734789cddced627295c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0621302251CE8185EA20AB15F44117FEBA0EBC9794F940172F7CE46BAADF2CC5598B20
                                                                                                                                                                                      Function 00007FF71AC3EBD0 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CallDecorator::getIndexatomicshared_ptr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3391904811-0
                                                                                                                                                                                      • Opcode ID: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                      • Instruction ID: a9a9f23e72e0817cbb6dfec6e7e3611f72feb7c5eae25701cf274d452f9eedc2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 112a7a1cfea1af6a49f72f60085d69459d96c49a4b2313b8b527eccd42334bbb
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8111B436628E8582DB50EB19E48115EB7B0FBC4B94F905162FB8E83B69DF3CC514CB00
                                                                                                                                                                                      Function 00007FF71AC02810 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4237134982-0
                                                                                                                                                                                      • Opcode ID: 60ca788769e2919534897e1b329648058ba67cc15df238ac90ca42c768f80c12
                                                                                                                                                                                      • Instruction ID: 98f19a66999fba980f9d6ef6c9aa167f36c608e05f67f66c429366f1856a9f38
                                                                                                                                                                                      • Opcode Fuzzy Hash: 60ca788769e2919534897e1b329648058ba67cc15df238ac90ca42c768f80c12
                                                                                                                                                                                      • Instruction Fuzzy Hash: DB113026609F4580EA30EB25E44132EE7A0FBC8BE4F441136EE8D83769CF3CD1448B50
                                                                                                                                                                                      Function 00007FF71AC158B0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_SchedulerScheduler::_allocator
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1883132607-0
                                                                                                                                                                                      • Opcode ID: 98c3c0ce34df0eaade2bc2e94a2f3454f8f2a84d40b179332c9cb56cb842f6a0
                                                                                                                                                                                      • Instruction ID: 57b16e107a1a6869924f98f5c7f6f49ca34b60a5f2eb790ca9e2b5e0d71d8b02
                                                                                                                                                                                      • Opcode Fuzzy Hash: 98c3c0ce34df0eaade2bc2e94a2f3454f8f2a84d40b179332c9cb56cb842f6a0
                                                                                                                                                                                      • Instruction Fuzzy Hash: DF01092261CD8691EA20FB14E4910EBE770FBD5394FD01173F6CE42AAADE2CC659CB50
                                                                                                                                                                                      Function 00007FF71AC65F00 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AttributesEnvironmentExpandFileStrings
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3836626501-0
                                                                                                                                                                                      • Opcode ID: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
                                                                                                                                                                                      • Instruction ID: d2640a832ce6b668d87fbfc8600785d24ecd2327e926fb5c1d33990d8f30cef9
                                                                                                                                                                                      • Opcode Fuzzy Hash: cf2b42f781f452ba8887e965ace6311404eaabd47bc012664cabe273c61bef76
                                                                                                                                                                                      • Instruction Fuzzy Hash: D7F04931A28A4682F770EB34E84932AA350FB98764FE00272E5AD866D4DE2CD40D8A10
                                                                                                                                                                                      Function 00007FF71AE02BD0 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1173176844-0
                                                                                                                                                                                      • Opcode ID: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                      • Instruction ID: 83ef18327fe551dbbae3b99b74e4731deb8ff1c7c57de718bccafd7d650d8c36
                                                                                                                                                                                      • Opcode Fuzzy Hash: 79828b8057ac0c13fd60be7f73fd30bcbbf421bb2b822df6622cab7814d851e4
                                                                                                                                                                                      • Instruction Fuzzy Hash: A1E0EC41F0DD0B45FD5835651AA71F781844F19370FA85BF2DABE042C6AD2CA49E8570
                                                                                                                                                                                      Function 00007FF71AE20DD4 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 485612231-0
                                                                                                                                                                                      • Opcode ID: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                      • Instruction ID: 3648274d198b5792cfaeb05e06d3db47dcc8069b2568e2eec3f65809fed62fbe
                                                                                                                                                                                      • Opcode Fuzzy Hash: b14f49c57cee8635011c431eaae8e23fe290bbf5ee1f602fc278b6c7871e509f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5DE01250F09E4642FE187BF2689717793565F94770F8814F7C90DD2692EE1CAA9C4260
                                                                                                                                                                                      Function 00007FF71AC917A0 Relevance: 3.0, APIs: 2, Instructions: 16COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Window$ShowUpdate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2310006639-0
                                                                                                                                                                                      • Opcode ID: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                      • Instruction ID: e296bcbc5975596ee63443429901a09f4a1bc621dfeb6d2b49366c51126a747e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 27d96b2e2a6ebb7af6f79fd039629226fea3c2d1ac42639d18c704751faeff7c
                                                                                                                                                                                      • Instruction Fuzzy Hash: FDE01A36A25B85C2EB40AF26D88122AA7A0F7C8B90F818062EA4D83764DF38C4498700
                                                                                                                                                                                      Function 00007FF71ABF97A0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2514311848-0
                                                                                                                                                                                      • Opcode ID: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                      • Instruction ID: 782f6673b300d9160b8f3683e720cff2615d5bbb43935b256918e561a71b1e0e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 815231a326fdbdcc2087a3ba038e825c9bf287463471365a8762f450db156d53
                                                                                                                                                                                      • Instruction Fuzzy Hash: CCC0C965E16B4691FA147B75A89A1256364AF49751FD09072C509416108E2C905D8B10
                                                                                                                                                                                      Function 00007FF71ACACB80 Relevance: 3.0, APIs: 2, Instructions: 10COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChildDesktopEnumWindowWindows
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2514311848-0
                                                                                                                                                                                      • Opcode ID: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                      • Instruction ID: dc76f389dd074050c9191fa6cf5e45573ea0adda8e373dfa80c04560ca900d59
                                                                                                                                                                                      • Opcode Fuzzy Hash: b0fd43d6e0e94c28da821d992680c33c943c97e8262ce344efbf5b071f0ff684
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0DC01275E1AF06D1FE047FB5E89A1356374BF49751FD09471C60D016109E3C905D8B10
                                                                                                                                                                                      Function 00007FF71AC81C90 Relevance: 1.6, APIs: 1, Instructions: 124COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: std::ios_base::goodstd::ios_base::width
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3809604888-0
                                                                                                                                                                                      • Opcode ID: 2a2846e93e5db7df07bb6832996b9040466f5d44ec8004fb6c09cb166d862753
                                                                                                                                                                                      • Instruction ID: 9ad186067d0cebee6274ef13ba709ce090dc898ce2d961e7b6f1515c92307b54
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2a2846e93e5db7df07bb6832996b9040466f5d44ec8004fb6c09cb166d862753
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9651FB62A0DB858AE620EF65E04136AF7E0FBC5794F404177E68E87B9ADE3CD5048F50
                                                                                                                                                                                      Function 00007FF71AC43110 Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC4312E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC20600: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC2060E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC20600: _Min_value.LIBCPMTD ref: 00007FF71AC20634
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Min_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1082587609-0
                                                                                                                                                                                      • Opcode ID: 9d47a527a287992c9996314e54d15d1e1de527d3fe80e14417b798960e6fe178
                                                                                                                                                                                      • Instruction ID: a39d34898e45e01d8099e2fd80bf94e4b9deb2ee63cc76b615bc2695a7e95dbd
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9d47a527a287992c9996314e54d15d1e1de527d3fe80e14417b798960e6fe178
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7651D376219F8885EA60DF5AF48026AF7A4F7C9B94F505126EECE43B69DF3CD1448B00
                                                                                                                                                                                      Function 00007FF71AC5C490 Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetWindowTextW.USER32 ref: 00007FF71AC5C4C6
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredTextWindowWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2447981796-0
                                                                                                                                                                                      • Opcode ID: 48e8f1467aa2ed651dada8ca62c2ad23af865c09b8ca47a9b4b5aa7e94cbfbb2
                                                                                                                                                                                      • Instruction ID: 7cf7d793f9da226c6872475d10fa9ed32aeeaaf8ce7dfd7ba65e8a961366dad4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 48e8f1467aa2ed651dada8ca62c2ad23af865c09b8ca47a9b4b5aa7e94cbfbb2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3041ED3261DB8196EA70AB15E4413ABF7A4FBC4354F800276E6DD86AA9DF2CD548CF10
                                                                                                                                                                                      Function 00007FF71ABEDE60 Relevance: 1.6, APIs: 1, Instructions: 89COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0A9EE
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: _Max_value.LIBCPMTD ref: 00007FF71AC0AA13
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: _Min_value.LIBCPMTD ref: 00007FF71AC0AA41
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABEDEFD
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF5BC0: char_traits.LIBCPMTD ref: 00007FF71ABF5C35
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuechar_traits
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3411602649-0
                                                                                                                                                                                      • Opcode ID: 1df19b742d0316808bc9db84e8ae44d97db72feeaeea29216a1e46e0cebb19e9
                                                                                                                                                                                      • Instruction ID: 20446539bdfd8635c32a8fa62bf0b6c2c251fa560ef2bb2176bbd3dcbfc92eb0
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1df19b742d0316808bc9db84e8ae44d97db72feeaeea29216a1e46e0cebb19e9
                                                                                                                                                                                      • Instruction Fuzzy Hash: A941AF3661DFC581DA60EB16F49026AB7A0F7C9B90F505426FACE83B2ACF3CD4548B50
                                                                                                                                                                                      Function 00007FF71AC4A3F0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __crt_scoped_stack_ptr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1704660383-0
                                                                                                                                                                                      • Opcode ID: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                      • Instruction ID: 34abe18628872c388d7d35065614604b2cf97776cb123e4f95713b3b7d82d822
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2b64867363028eff0c91442592d46d6c6cb3060f987761c6e3f93457ab4b6b66
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7541F67260DB8181EA60EF15E4503AFB7A1FBC4794F805162EACD87BA9DF2CD548CB50
                                                                                                                                                                                      Function 00007FF71AE25314 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                      • Instruction ID: e7cc829fd6a420d89a7b930f61f0ffa1850d7b321968781bcaacfb7a8e165908
                                                                                                                                                                                      • Opcode Fuzzy Hash: 321343d00294838cecd101b12ef5f71ea6e8db055736ae24a32fa14de0d5b621
                                                                                                                                                                                      • Instruction Fuzzy Hash: C4318F21A18A4286F7217F65895237FA660AB40BB0FC511BBD91E833D2CEBCE44D8631
                                                                                                                                                                                      Function 00007FF71ABEB760 Relevance: 1.6, APIs: 1, Instructions: 76COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0A97E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: _Max_value.LIBCPMTD ref: 00007FF71AC0A9A3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: _Min_value.LIBCPMTD ref: 00007FF71AC0A9D1
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABEB79C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 348937374-0
                                                                                                                                                                                      • Opcode ID: 8859461f35b78703a19ec5d8ba9d8f41fd2515d4856150d59d59d2e4174acf1b
                                                                                                                                                                                      • Instruction ID: dafebc51e284d67dd2ff12a227436807491071d97aefbfa2c413e340605940da
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8859461f35b78703a19ec5d8ba9d8f41fd2515d4856150d59d59d2e4174acf1b
                                                                                                                                                                                      • Instruction Fuzzy Hash: ED31F93661DF8181EA70EB15F49126AE7A4F7C87A0F505536EACD83B69CF3CC5488B50
                                                                                                                                                                                      Function 00007FF71AC40200 Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC40227
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0A9EE
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: _Max_value.LIBCPMTD ref: 00007FF71AC0AA13
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A9E0: _Min_value.LIBCPMTD ref: 00007FF71AC0AA41
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 348937374-0
                                                                                                                                                                                      • Opcode ID: 519ebc12d16e4ce1589a7a5f2048e9b42ca6661634370256d99bddfb45fce985
                                                                                                                                                                                      • Instruction ID: 795be4f39fd421c4369e61d103ba645e30d014923ca5fbbea34928dd9f2ddb9b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 519ebc12d16e4ce1589a7a5f2048e9b42ca6661634370256d99bddfb45fce985
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6231D63651CF8181EA60EB15F4812AEF7A4F7C87A4F905166EACD83B69DF3CC5488B50
                                                                                                                                                                                      Function 00007FF71ADA0210 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • CreateEventW.KERNEL32 ref: 00007FF71ADA0238
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA0D40: _Ptr_base.LIBCPMTD ref: 00007FF71ADA0E31
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA22D0: RegNotifyChangeKeyValue.KERNEL32 ref: 00007FF71ADA2308
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA22D0: FormatMessageW.KERNEL32 ref: 00007FF71ADA2353
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA22D0: RegCloseKey.ADVAPI32 ref: 00007FF71ADA236C
                                                                                                                                                                                        • Part of subcall function 00007FF71ADA22D0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF71ADA238D
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ChangeCloseCreateEventFormatMessageNotifyPtr_baseValuestd::bad_exception::bad_exception
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1108121324-0
                                                                                                                                                                                      • Opcode ID: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                      • Instruction ID: 2d9e530260ee53f9183d59d3185aa9d671f18b44d313c355bf1309e4f6f7c333
                                                                                                                                                                                      • Opcode Fuzzy Hash: d131e54128c23b049350c72a160e8f6a443448de3b4584595088c6dbcf7bcdaa
                                                                                                                                                                                      • Instruction Fuzzy Hash: F131B236619F8581EAA0EB15F88139FB7A4FBC4B90F505126EACD83B29DF3CD1558B40
                                                                                                                                                                                      Function 00007FF71AD9E070 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Initialize
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2538663250-0
                                                                                                                                                                                      • Opcode ID: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                      • Instruction ID: a4c1473e4f5ff2596696fb329370dff0c3299ed3cb11d5e4fd187dac52847ef6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 56cb18ff6626b283ffe465cba34704dc4daad80764cd781178f4e76e5ddfb6ff
                                                                                                                                                                                      • Instruction Fuzzy Hash: E7210872A1CF4582EA10EB29E45152AE3A1FBC57A4F904576E6CD43B6ADF3CC01A8B14
                                                                                                                                                                                      Function 00007FF71AC02D10 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: char_traits
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1158913984-0
                                                                                                                                                                                      • Opcode ID: f866591728b39b89ea805870e913918d5676a938f5fc4b9565843e629cb0418a
                                                                                                                                                                                      • Instruction ID: 25cc002286dad203b7807780fabe499fbdd570889d0e7791645a8bad125479a2
                                                                                                                                                                                      • Opcode Fuzzy Hash: f866591728b39b89ea805870e913918d5676a938f5fc4b9565843e629cb0418a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D21B536619B89C6DA44DB5AF49016AA7A1F7C9BC0F501126FF8E83B69DF3CD055CB00
                                                                                                                                                                                      Function 00007FF71ADA0D40 Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Ptr_baseRef_count_baseRef_count_base::_std::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1305008675-0
                                                                                                                                                                                      • Opcode ID: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                      • Instruction ID: 9566d7fcb8a83c4c65a3c3d915802b3400a7006ce208000f1b2d0ee796d84b97
                                                                                                                                                                                      • Opcode Fuzzy Hash: a63b27ea6810d4f19100fe72ce9d08e0d90dad19ea0bee4daec0c1428a8f0f12
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2A31E23250CF8582E660AB19F4813ABB7A0FB85790F500536EBCE47B69DF3CD0588B50
                                                                                                                                                                                      Function 00007FF71AE30B14 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                      • Instruction ID: 9f678aad00c96272b4c395583a3f115c5ada61d41d44ef1fc0a20e9a089029cd
                                                                                                                                                                                      • Opcode Fuzzy Hash: e48b0f802f846f83354f8bcc0381103829573c63fa65d85b6fc9dff923b52bf1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 28219832A08E4186EB61BF18D44137AB6A1EF84F74F544276D65D876D9DF3DD40C8710
                                                                                                                                                                                      Function 00007FF71AE10240 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                      • Opcode ID: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                      • Instruction ID: 34de920bfb2bc7fa670126c42cf6688ed2596c975af6205422c3cdbf65fdd3bb
                                                                                                                                                                                      • Opcode Fuzzy Hash: bbdd6f4acd2c37f0f0cea18607fb670f7e5b7d0a06c147e43de415a555d17051
                                                                                                                                                                                      • Instruction Fuzzy Hash: 53119021B1CA9181FA60BF5194122BFE660BF84BB0F8440B3EA8C57A87CF7DD50C8760
                                                                                                                                                                                      Function 00007FF71AC3DEC0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Byte_lengthchar_traits
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4053119236-0
                                                                                                                                                                                      • Opcode ID: 097e86923d6dbb440cff8f9aa3cec441127c99b8c599f981f94ec522065ddffe
                                                                                                                                                                                      • Instruction ID: 8e65d516e62fac02328d19d4410e16d0e1aae63456e7cacaba529948886ea380
                                                                                                                                                                                      • Opcode Fuzzy Hash: 097e86923d6dbb440cff8f9aa3cec441127c99b8c599f981f94ec522065ddffe
                                                                                                                                                                                      • Instruction Fuzzy Hash: AB21062251CE8582E660EB19E4801AEF7A4FBD47A0F905163FACD43B69DF3CC5588B50
                                                                                                                                                                                      Function 00007FF71AC8B530 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 162856716-0
                                                                                                                                                                                      • Opcode ID: a6f52692b4221cf8e344038bc2133ad2acadf011ad9ecd7645a69deb537d6bee
                                                                                                                                                                                      • Instruction ID: b69e1e65ac7d424576a9a06629a2f7240cab3118ad1d10786b8d9ca415e8b947
                                                                                                                                                                                      • Opcode Fuzzy Hash: a6f52692b4221cf8e344038bc2133ad2acadf011ad9ecd7645a69deb537d6bee
                                                                                                                                                                                      • Instruction Fuzzy Hash: 98211A3251DE8582E650EB25E49126EB7A0FBD5790F905036F68D43BA9CF3CC415CB10
                                                                                                                                                                                      Function 00007FF71ABEEC10 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 162856716-0
                                                                                                                                                                                      • Opcode ID: b53e5842288276e939d4d8de75e71ee6bbf2d876da764cb478c09da6b84a371d
                                                                                                                                                                                      • Instruction ID: daa6b767958cf6fc54baa10230ee854850396d9e0beb6c212d27251a132d73aa
                                                                                                                                                                                      • Opcode Fuzzy Hash: b53e5842288276e939d4d8de75e71ee6bbf2d876da764cb478c09da6b84a371d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E21293251DF8182E660EB24E4912AEB7A0FBD5790F905036F68D53BA9CF3CC459CB10
                                                                                                                                                                                      Function 00007FF71AC9AF70 Relevance: 1.5, APIs: 1, Instructions: 45stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: strrchr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3418686817-0
                                                                                                                                                                                      • Opcode ID: b7b14b5c9d08d4744fb22ef96e2550b1bfc98445a318f371b333cb3e93d0c49d
                                                                                                                                                                                      • Instruction ID: 8a08dabaa70d18e52edcfadd202d8dce7ca278bfdc3af4753f6a26117b9389bc
                                                                                                                                                                                      • Opcode Fuzzy Hash: b7b14b5c9d08d4744fb22ef96e2550b1bfc98445a318f371b333cb3e93d0c49d
                                                                                                                                                                                      • Instruction Fuzzy Hash: FE11C276608B8886DB20DF49E49061AF7A0F7C8BA4F504526EA8D83B68DBBCD415CF40
                                                                                                                                                                                      Function 00007FF71ADCED80 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 162856716-0
                                                                                                                                                                                      • Opcode ID: ce57335518120c5bda6fde6f65474542a5aa26ce41ed83ae2f5198cd6978d16d
                                                                                                                                                                                      • Instruction ID: 3124d65a8560e5353c9d1903fbfc3f05b113223d60d46d12869dffbb99929c4c
                                                                                                                                                                                      • Opcode Fuzzy Hash: ce57335518120c5bda6fde6f65474542a5aa26ce41ed83ae2f5198cd6978d16d
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B1119B2629F8982E610EB11E4512AAB365FBC5B90F805436F68E477A9DE3CD408CB50
                                                                                                                                                                                      Function 00007FF71ACA63D0 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 162856716-0
                                                                                                                                                                                      • Opcode ID: 31c809492498f58add146ec5b3123e21cd9b5a396ad75c3adf6fc977d4ff10c1
                                                                                                                                                                                      • Instruction ID: 9853ce7a8cdb15b2c21a0b473893f09dfd90b2c65f22dbec42eef1fd03e666b5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 31c809492498f58add146ec5b3123e21cd9b5a396ad75c3adf6fc977d4ff10c1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 62111332629F8582E650EF11E4912AAB361FBC5B90F804476F68E867A9DE3CD518CB10
                                                                                                                                                                                      Function 00007FF71ACA6310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Cpp_errorThrow__invalid_parameter_noinfostd::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 162856716-0
                                                                                                                                                                                      • Opcode ID: ad2e2740e0eb9326f266704e195f92b79a9eeec99dfb4f6a18dcc723286843f5
                                                                                                                                                                                      • Instruction ID: 166d9cc1dd9d34d699917a83c52d09e0f1575c6befc01a2dc5c5b05c77d74787
                                                                                                                                                                                      • Opcode Fuzzy Hash: ad2e2740e0eb9326f266704e195f92b79a9eeec99dfb4f6a18dcc723286843f5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D111632629F8582E650EF11E4912AEB761FBC5B50F804476F68E467A9DE3CD419CB10
                                                                                                                                                                                      Function 00007FF71AD9FAE0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Ref_count_baseRef_count_base::_std::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1391782822-0
                                                                                                                                                                                      • Opcode ID: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                      • Instruction ID: 76be470645865dedb1549cd7a1dae84e1a67b451dae23c09905710aa952f7e9a
                                                                                                                                                                                      • Opcode Fuzzy Hash: b0097962b4dfde2aa14eab4b58734fd89c11c4c6999dc842a1ef436c9f199952
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4111C33261CF8982EA50EB1AF45016BB7A1FBC4B90F505426EACD43B69CE38D0648B50
                                                                                                                                                                                      Function 00007FF71ADBCAF0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FreeTask
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 734271698-0
                                                                                                                                                                                      • Opcode ID: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                      • Instruction ID: d16885725c3abbfe196ccef20cc51a357603c7385c0e3f2915895faa8747944a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1390414adff6cff9572c19d13d4af55dc9366da79f4f2d16f28cb309ed5a3294
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C11EC72628E45C2E720EF26E45165AB361FBC8758F801172F6CD86A59DF3CD608CF00
                                                                                                                                                                                      Function 00007FF71ABEB050 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC02260: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00007FF71AC02269
                                                                                                                                                                                      • _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF71ABEB092
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo_noreturnstdext::threads::lock_error::lock_error
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 414106306-0
                                                                                                                                                                                      • Opcode ID: d482c9dbe7f8947c5127e3c2cf07479238420b84e503d3de23eadfc201975595
                                                                                                                                                                                      • Instruction ID: 40a6ef6957b68655c4bb94056ddf7e616c7e90c8ae91fb3b1e112a80733d4a58
                                                                                                                                                                                      • Opcode Fuzzy Hash: d482c9dbe7f8947c5127e3c2cf07479238420b84e503d3de23eadfc201975595
                                                                                                                                                                                      • Instruction Fuzzy Hash: 53015262619F8681E670AB28E44131BE394FFD47B4F408232E5DD52795DF3CD5148714
                                                                                                                                                                                      Function 00007FF71ABF4F80 Relevance: 1.5, APIs: 1, Instructions: 34stringCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWidestrrchr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 276481755-0
                                                                                                                                                                                      • Opcode ID: d1af9af09f29db918b7267e213ab1c135448751c064e413e2e63a4f61bf1d1a1
                                                                                                                                                                                      • Instruction ID: 0fab4fa484918111d72581a69739f853863433bf027ad9cb9ebab68a8df1f7d1
                                                                                                                                                                                      • Opcode Fuzzy Hash: d1af9af09f29db918b7267e213ab1c135448751c064e413e2e63a4f61bf1d1a1
                                                                                                                                                                                      • Instruction Fuzzy Hash: A201CC3250CA8286E630EF15E45026AF7A0F7C9768F640276F6CD47A99CF3DD9488F50
                                                                                                                                                                                      Function 00007FF71ABF0E90 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71ABEB760: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABEB79C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1865873047-0
                                                                                                                                                                                      • Opcode ID: 0845a3ead8417d5c72c21395f1a6fec31c22ca1d6f810d21a90ab9cdca1ddcea
                                                                                                                                                                                      • Instruction ID: 64de2aad6898ab63ec8f58b342ad0b3349bebcb098817d3f1e086e0b1db269b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0845a3ead8417d5c72c21395f1a6fec31c22ca1d6f810d21a90ab9cdca1ddcea
                                                                                                                                                                                      • Instruction Fuzzy Hash: D101D03661DFC581DA61AB16E48006FFBA1FBCAB90F400166FACD43B6ACF2CD1148B50
                                                                                                                                                                                      Function 00007FF71ADB5DD0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ADB5DED
                                                                                                                                                                                        • Part of subcall function 00007FF71AC65CE0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC65CF1
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1865873047-0
                                                                                                                                                                                      • Opcode ID: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                      • Instruction ID: 9837af797ae7e622fae83eba1b8e2f04a567f2792640e3c60d3d3ad760c7dd6b
                                                                                                                                                                                      • Opcode Fuzzy Hash: f53a0104ca1699a1dff8dd9072ce108e638b513950ee8d3201b6f48fb5c4f35b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 57014276608B8886DB10DF1AE49121ABB70F7D9B85F608126EB8D43B29CF3DD515CB40
                                                                                                                                                                                      Function 00007FF71AC8FFE0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Name$NodeNode::
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2544435820-0
                                                                                                                                                                                      • Opcode ID: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                      • Instruction ID: 3b810c47ee9bacb6eb994c7d216b45a9becf51a77cbdf272d4446b1c3163d98b
                                                                                                                                                                                      • Opcode Fuzzy Hash: c5eb3d4471621ccbc52861cf316ed1686c60dd9bf9f3c63ff2dc3039ce938ba5
                                                                                                                                                                                      • Instruction Fuzzy Hash: FD01E576A08B8182EA10EF15E48126EB3B0F7C5794FA04526EB8D43B69DF7DC509CB10
                                                                                                                                                                                      Function 00007FF71AC5C410 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: atomic
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1039557753-0
                                                                                                                                                                                      • Opcode ID: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                      • Instruction ID: 9c236c1c4de5f2e875c5d8f549d72c71c0c45131f82f8807827997c63d4c1080
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9ca185a43521d589ea1ec58c1bf6d9d8244aa92ec9fc2ff649280413e46ebf07
                                                                                                                                                                                      • Instruction Fuzzy Hash: E7F02C26628E8582CA60EF25E08006BB371FBC9794B905262FA8E53B29DF38C5548B00
                                                                                                                                                                                      Function 00007FF71AC6D800 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FromMonitorPoint
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1566494148-0
                                                                                                                                                                                      • Opcode ID: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                      • Instruction ID: 66600042597f2dcb214c969ebfd6e14022d7013588ada9f17b4d98fcd3afd1b9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c796e21bcbbd32d9733918cfdc4da3585dd35d9ebd39644cbc39d00fd814335
                                                                                                                                                                                      • Instruction Fuzzy Hash: DEF04B32928E8586D212EF34E44125BF7B1FFC9784F505226F28E16A19DF3CC48A8B40
                                                                                                                                                                                      Function 00007FF71AC65FA0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: QueryRecycle
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2469249176-0
                                                                                                                                                                                      • Opcode ID: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                      • Instruction ID: 766e37144a8d383b2c99f80a2b94c3db3aa006d8453bf2a5328f304457197ac3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 934cc2852b4868eeabf2003547c0e9231da6ab5e154a758072a7bf41caf7e24a
                                                                                                                                                                                      • Instruction Fuzzy Hash: B0F01D3191CE8A92FA50BF20E44136AA3A1FBA5710FE051B2E64E42A84DF3DD50D9B21
                                                                                                                                                                                      Function 00007FF71ABF11A0 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71ABEB440: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABEB479
                                                                                                                                                                                        • Part of subcall function 00007FF71ABEB440: char_traits.LIBCPMTD ref: 00007FF71ABEB4FC
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Char_traitsConcurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1047894033-0
                                                                                                                                                                                      • Opcode ID: 4d1e15c29e2c58c076d7548f746cc21e50f1f61a2693eac54edc13d70f68b773
                                                                                                                                                                                      • Instruction ID: 0b911fbf07655fe605707361ee1a60312cf05ed6d2d3fa04c7f765263936d856
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4d1e15c29e2c58c076d7548f746cc21e50f1f61a2693eac54edc13d70f68b773
                                                                                                                                                                                      • Instruction Fuzzy Hash: 31E01C2290CE8581DA20FB15E45102FA7B0FBC67D4F904172EBCC13B2ACE2CC5158B10
                                                                                                                                                                                      Function 00007FF71ABF0F30 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71ABEB5D0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABEB609
                                                                                                                                                                                        • Part of subcall function 00007FF71ABEB5D0: char_traits.LIBCPMTD ref: 00007FF71ABEB68C
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3215207624-0
                                                                                                                                                                                      • Opcode ID: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                      • Instruction ID: 442752d7757ec2e58b7509ddfe62dc07eda862eb649936fc0895d06d0074523f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 439046dc0d3d0137d2424e1f1b116a87ab26bfc4525b92261c69718bc40d6492
                                                                                                                                                                                      • Instruction Fuzzy Hash: 89E01C2290CF8581DA20FB15E45102BA7B0FBD67D0F904572EBCC13B2ACE2CC5158B10
                                                                                                                                                                                      Function 00007FF71AC667B0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: EnumWindows
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1129996299-0
                                                                                                                                                                                      • Opcode ID: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                      • Instruction ID: 64c6771a38d1b0f05966381b58bdad6c7981b16fb07e02ebb5e5dc66bc30568f
                                                                                                                                                                                      • Opcode Fuzzy Hash: dbb1f573b530a87190cc711aa1b050e54dc1485b87a9a9082699a202dfc258a2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 35F0FE72A1894592EA20EF14E4410BAF770F7C43A8F801262F68D46A69DF6CD64DCF10
                                                                                                                                                                                      Function 00007FF71ABF6C30 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Func_classstd::bad_exception::bad_exception
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3621584023-0
                                                                                                                                                                                      • Opcode ID: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                      • Instruction ID: 93811c57b9f593f79d5155bd3fab2cd3d824df0853a7c63252d7ca13931e5188
                                                                                                                                                                                      • Opcode Fuzzy Hash: 811ec457467a64cf29189dc53ead4d07727bd2a83de33478318602b153d018cd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 16E01222A18FC685EA20BB21E85106EB370FBD5790F904172EACD43766CE2CC4198A10
                                                                                                                                                                                      Function 00007FF71AC59BE0 Relevance: 1.5, APIs: 1, Instructions: 14comCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 542301482-0
                                                                                                                                                                                      • Opcode ID: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                      • Instruction ID: ecbdab107f473b81e0d21e1f21db75681333cdae31dfd9a2d133025d9ba23e93
                                                                                                                                                                                      • Opcode Fuzzy Hash: 82772c17aba477afe5628f88038786c146a768299862a8ae95623a60e00681d5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2AE07576908B8482D610EF55F44104AB774F795794F904526EACC02B28CF7CC169CF40
                                                                                                                                                                                      Function 00007FF71AC251F0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: std::bad_exception::bad_exception
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2160870905-0
                                                                                                                                                                                      • Opcode ID: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                      • Instruction ID: 5a9f4c07cc85a9668815dc454580debae434aab423a32ed954bb6be2e7d8667d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 378930b60c09186e0c0f67021e624062e6a22285b3f326e3715c0ac8b94d4612
                                                                                                                                                                                      • Instruction Fuzzy Hash: 64E0EC66A1DE4482E620EF1AE48001FF361FBC87A4F401173FA8E43B6ADE6CC1148B14
                                                                                                                                                                                      Function 00007FF71AC843A0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __std_fs_directory_iterator_open.LIBCPMT ref: 00007FF71AC843C5
                                                                                                                                                                                        • Part of subcall function 00007FF71ADE75F8: FindClose.KERNEL32(?,?,?,?,?,00007FF71AC843CA), ref: 00007FF71ADE7619
                                                                                                                                                                                        • Part of subcall function 00007FF71ADE75F8: FindFirstFileExW.KERNEL32 ref: 00007FF71ADE763B
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Find$CloseFileFirst__std_fs_directory_iterator_open
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3791046848-0
                                                                                                                                                                                      • Opcode ID: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                      • Instruction ID: a77d40f93a7d26f752bade3a241d124ac751141386dfcc4f0e6db10dafa7d685
                                                                                                                                                                                      • Opcode Fuzzy Hash: 85fdb631bab1a170bc59e4487b9b1b9b43ae0330781ff348048b17804e7260d1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 91D09EB6919F8481CA44EB12F88104AB764F7D97C0F505425FACD53B29DF3CC1658B40
                                                                                                                                                                                      Function 00007FF71ADE75B8 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileFindNext
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2029273394-0
                                                                                                                                                                                      • Opcode ID: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                      • Instruction ID: 920ac90d15914a82d90745578dd9f43cdb312b63d66a814443e6130fcab2a592
                                                                                                                                                                                      • Opcode Fuzzy Hash: 065cdcbe97f106e0eade9506be4ef307043f165ef828597f3074fb4363c91a61
                                                                                                                                                                                      • Instruction Fuzzy Hash: FAC04C24F1AD46C1FA5837725C831225394AB55760FD444F2C10CD0250DD1C91EE4631
                                                                                                                                                                                      Function 00007FF71ABEAF60 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: allocator
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3447690668-0
                                                                                                                                                                                      • Opcode ID: 263be013334641b4032aabf44553dde502a18f0c278bf710d10114a2551f6ba5
                                                                                                                                                                                      • Instruction ID: 3b26e7325779cf16d7954aa8610ca6c2f0d4fdb6a28c666989002fb0d430d525
                                                                                                                                                                                      • Opcode Fuzzy Hash: 263be013334641b4032aabf44553dde502a18f0c278bf710d10114a2551f6ba5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 04C0C96AA29F8481CA44EB12F48101AB360F7C8BD0F809421EA8E13729CF38C0948B00
                                                                                                                                                                                      Function 00007FF71ABEAF30 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: allocator
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3447690668-0
                                                                                                                                                                                      • Opcode ID: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                      • Instruction ID: 540f490d24b55fef6fa61a022c999f67d6f86377b5fb1a241e0c83e3747f412c
                                                                                                                                                                                      • Opcode Fuzzy Hash: dec3b39dd94d1f2ea7fefd5dc669bf3bce3c72644ec74f011e531bc41841e9f6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 21C0C96AA29F8481CA04EB12F48100AB360F7C8BC0F809421EA8E03729DF38C0548B00
                                                                                                                                                                                      Function 00007FF71AE20E10 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4292702814-0
                                                                                                                                                                                      • Opcode ID: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                      • Instruction ID: b2f22d658c300d749bc58a70cf8689625adf16a99d016da140d26e3d32e0bbd9
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ab3abee0b0df280f6ea689347e8a0d30cae0e72a40c9bae681347ef5c9e1206
                                                                                                                                                                                      • Instruction Fuzzy Hash: 23F05E51B0DE0645FE6477616953277DA915F88B70F880ABBDC2E852C2DE1CA88D8530
                                                                                                                                                                                      Function 00007FF71ABFA4A0 Relevance: 1.3, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 626452242-0
                                                                                                                                                                                      • Opcode ID: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                      • Instruction ID: 64107f5f4f97d30afdee97fa50b83c9bda7a9e3ffdca39f696a0e270aecb1a91
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0b0b72c7a2bbd2b06bfd941d9483a5493affec11b1419866e72d6a85d5fe652c
                                                                                                                                                                                      • Instruction Fuzzy Hash: C5D05B71A08E81C1E7307B75A41535BABA1FBC4764F504265D6D9476E4DF3DC0498B40
                                                                                                                                                                                      Function 00007FF71ABF7F00 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AllocHeap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 4292702814-0
                                                                                                                                                                                      • Opcode ID: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
                                                                                                                                                                                      • Instruction ID: 4c133fc9e27458d50d14c9b3a727f26a98decf4d4ed5f93942d8e7cfe2a34b3b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 64d30b65498477a3495af4626b3c505657476d8f41d5f7a5527f686b3be6af0a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 75D0C771915F80C1D604EB17F84100AB7A4FBC8784F809465E68D47734CF38C0958B00
                                                                                                                                                                                      Function 00007FF71AC58C10 Relevance: 1.3, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Uninitialize
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3861434553-0
                                                                                                                                                                                      • Opcode ID: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                      • Instruction ID: 1f4d9db83d58270f658b8f47bcc7095c062aaab10a8cb4d3c23c119249d7d992
                                                                                                                                                                                      • Opcode Fuzzy Hash: 63a70c0b2080d31044b73d5fc0420380379576a7f457e1623dfecf2492aaa18f
                                                                                                                                                                                      • Instruction Fuzzy Hash: B2B01235D29A45C1D9043B75B8CB0096328B799301FE0C070C148001108E2C40AE4B10

                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                      Function 00007FF71ADE76A8 Relevance: 27.2, APIs: 18, Instructions: 229fileCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2398595512-0
                                                                                                                                                                                      • Opcode ID: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
                                                                                                                                                                                      • Instruction ID: 53d2b8fa63fd308d9062d3399ff76ca68ea679bc200b1ffb37bf17415387d505
                                                                                                                                                                                      • Opcode Fuzzy Hash: 355334dcceae02b49ab9097a0ac3bef8698e95b7cc128a7e9a7f23a438070136
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9A91BA31B08E4A46F6A87B25A801676A3A4EF65770F850372D9FD576D8DF3CE80C8720
                                                                                                                                                                                      Function 00007FF71AC71E10 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • std::bad_exception::bad_exception.LIBCMTD ref: 00007FF71AC71E3E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC565A0: std::bad_exception::bad_exception.LIBCMTD ref: 00007FF71AC565B8
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      • GetProcessHeap.KERNEL32 ref: 00007FF71AC71E55
                                                                                                                                                                                      • HeapAlloc.KERNEL32 ref: 00007FF71AC71E64
                                                                                                                                                                                      • std::bad_alloc::bad_alloc.LIBCMTD ref: 00007FF71AC71E7B
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Heapstd::bad_exception::bad_exception$AllocExceptionFileHeaderProcessRaisestd::bad_alloc::bad_alloc
                                                                                                                                                                                      • String ID: length
                                                                                                                                                                                      • API String ID: 760574106-25009842
                                                                                                                                                                                      • Opcode ID: 5c0fcbe49bfe53a51c9c6909a439c2f15d3f8fd499fdc297643477aa614b99e6
                                                                                                                                                                                      • Instruction ID: 07db7bd72fcae6ef1162e527a8140ab7682ec3d82200fe3ce13516fdb77615dc
                                                                                                                                                                                      • Opcode Fuzzy Hash: 5c0fcbe49bfe53a51c9c6909a439c2f15d3f8fd499fdc297643477aa614b99e6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 62211D72A18E4682EE20EF19E44126AA7A0FBC8758FD04176F68D477A9DF3CD549CB10
                                                                                                                                                                                      Function 00007FF71ADE1254 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF71ADE12D7
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CriticalInitializeSection$DebugDebuggerErrorLastOutputPresentString__vcrt_
                                                                                                                                                                                      • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                                                                                                                                                      • API String ID: 3055932891-631824599
                                                                                                                                                                                      • Opcode ID: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
                                                                                                                                                                                      • Instruction ID: 034bc6f3b42427cac450a578f380c5ecb5a059c2f66453f40258f4d91230b12e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 536e1cbde581abdcf4f6eeb0427798af8337269c14b6612caf455d91a3591f50
                                                                                                                                                                                      • Instruction Fuzzy Hash: DC115B32A14F4296F704BB22DA463AA63A4FB14760F804176C64D82A54EF3CE0AC8720
                                                                                                                                                                                      Function 00007FF71AC67BE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC5A6B0: GetUserDefaultUILanguage.KERNEL32 ref: 00007FF71AC5A6DE
                                                                                                                                                                                        • Part of subcall function 00007FF71AC5A6B0: LCIDToLocaleName.KERNEL32 ref: 00007FF71AC5A6FD
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • GetLocaleInfoEx.KERNEL32 ref: 00007FF71AC67CA4
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC67CF1
                                                                                                                                                                                      • GetLocaleInfoEx.KERNEL32 ref: 00007FF71AC67D24
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyLocaleQueue::StructuredWorkshared_ptr$Info$Char_traitsDefaultLanguageNameUsertype_info::_name_internal_method
                                                                                                                                                                                      • String ID: unknown
                                                                                                                                                                                      • API String ID: 378872536-2904991687
                                                                                                                                                                                      • Opcode ID: 7ea18aa41189f604505658433f95895da665b249721bb73c7dc60cd3848cc4e1
                                                                                                                                                                                      • Instruction ID: de439161146d52946956d42a4a5e1db8888fb2057dd0e5a760eebe8bc29cba44
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7ea18aa41189f604505658433f95895da665b249721bb73c7dc60cd3848cc4e1
                                                                                                                                                                                      • Instruction Fuzzy Hash: E7412F3261DE8191EA70EB14E4517AFF7A0FBC5790F805172E68D83BAADE2CD548CB50
                                                                                                                                                                                      Function 00007FF71ADE7B24 Relevance: .0, Instructions: 10COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
                                                                                                                                                                                      • Instruction ID: 4a100a0b4c1497965c7124c67c36c92903d4d632a673809317998dbd8bc5493e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 96deb49f9c9e0e377063350eb5d5da8a57a3189ba4225a268213569ed96476fb
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4CC01220F0AE45C1FD083B22A88702A9354AF19721FC454F2C00C05324DE2C619E4720
                                                                                                                                                                                      Function 00007FF71AC83500 Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 342COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39B51
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39B8C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39AA0: shared_ptr.LIBCMTD ref: 00007FF71AC39BC8
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0EAD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC395B3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC39580: shared_ptr.LIBCMTD ref: 00007FF71AC3963C
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC8373C
                                                                                                                                                                                        • Part of subcall function 00007FF71AC7F990: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC7F9B2
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83916
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83B17
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83BAB
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83BC1
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83C03
                                                                                                                                                                                        • Part of subcall function 00007FF71AC82250: Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 00007FF71AC822BA
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83C3C
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83C62
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$EmptyQueue::StructuredWork$shared_ptr$ProcessorProxyRoot::SchedulerVirtualchar_traitstype_info::_name_internal_method
                                                                                                                                                                                      • String ID: \HRDR_places.sqlite$\Mozilla\Firefox\Profiles\$\places.sqlite$appdata$temp
                                                                                                                                                                                      • API String ID: 2671280029-1746454586
                                                                                                                                                                                      • Opcode ID: 4390d2d651aca31891293e9fdbe01f198000d7ebef06b7fccdc7e64e2cfd7081
                                                                                                                                                                                      • Instruction ID: fddaa819cc348b3260c179b205269756d6cbdc9d56cbe6f040aea46e08e610a6
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4390d2d651aca31891293e9fdbe01f198000d7ebef06b7fccdc7e64e2cfd7081
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1712C73260EFC294EA71AB11E4913EBB364FBC4790F805176D68D43B6AEE2CD548CB50
                                                                                                                                                                                      Function 00007FF71AC1D788 Relevance: 21.4, APIs: 5, Strings: 7, Instructions: 369COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1D89B
                                                                                                                                                                                      • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71AC1D9B6
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1DADA
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1DC58
                                                                                                                                                                                      • Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00007FF71AC1DDBB
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$EmptyQueue::StructuredWork$Affinity::operator!=Hardware
                                                                                                                                                                                      • String ID: "bytes": [$"subtype": $],$],"subtype":$null$null}${"bytes":[
                                                                                                                                                                                      • API String ID: 2268291814-3853568864
                                                                                                                                                                                      • Opcode ID: 62cd5a440f190d55e1cd79f453e4afa18557a6c443adb3c6639d2d035e0afc39
                                                                                                                                                                                      • Instruction ID: 633c81dc1ad79406b0802fd230fbbf41ba31033336ae8dbc6e61edc1d33c2ff2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 62cd5a440f190d55e1cd79f453e4afa18557a6c443adb3c6639d2d035e0afc39
                                                                                                                                                                                      • Instruction Fuzzy Hash: F712C776609FC580EA70EB16E4903AEB3A5FBC9B90F804066DB8D47B69DF2CC544CB54
                                                                                                                                                                                      Function 00007FF71AC03B30 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 306COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC03E21
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC03E9B
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC03F2D
                                                                                                                                                                                      • UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71AC03FA7
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC72347
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegQueryValueExW.KERNEL32 ref: 00007FF71AC72392
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72310: RegCloseKey.ADVAPI32 ref: 00007FF71AC723A1
                                                                                                                                                                                      • SetEvent.KERNEL32 ref: 00007FF71AC04217
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Decorator::getTableType$Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsCloseCreateEventQueryValuetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: RES_COUNT$exit$product$product$reason=%ws$reload${"app" : { "close_app" : 1}}
                                                                                                                                                                                      • API String ID: 1544965098-3700722040
                                                                                                                                                                                      • Opcode ID: 987c1c9f200f45de5dce231fd5bc8e9b277dc62ba9636b847cbb53f1709a633e
                                                                                                                                                                                      • Instruction ID: ae51d1785d9a20fe6e532e7d60eb8915199fadeb4840ecdf4b8183473fb5065a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 987c1c9f200f45de5dce231fd5bc8e9b277dc62ba9636b847cbb53f1709a633e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2402C33660DFC295EA71AB15E8902EBB364FBC9350F805176D6CD83B69EF28D548CB10
                                                                                                                                                                                      Function 00007FF71AC2DB80 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 182COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Decorator::getTableType$std::ios_base::good$Concurrency::task_continuation_context::task_continuation_context
                                                                                                                                                                                      • String ID: %5B$%5B$%5D$%5D
                                                                                                                                                                                      • API String ID: 1894544629-3613181305
                                                                                                                                                                                      • Opcode ID: 42933e79853cbeb047eccf4e8039041145a713ce86a9cbb0e2f27531e555f8da
                                                                                                                                                                                      • Instruction ID: 592aabcd36dad06e4d0a23963ce127ec231f99237122ea933c42e149d5da05a2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 42933e79853cbeb047eccf4e8039041145a713ce86a9cbb0e2f27531e555f8da
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5991FC3251DEC6A0EA70AB14E8413EBE360FBD9750F805573D68D83BAADE2CD558CB50
                                                                                                                                                                                      Function 00007FF71AC0BD30 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 200COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32 ref: 00007FF71AC0BDA5
                                                                                                                                                                                        • Part of subcall function 00007FF71AC6CF90: RegOpenKeyExW.ADVAPI32 ref: 00007FF71AC6D0F6
                                                                                                                                                                                        • Part of subcall function 00007FF71AC6CF90: RegQueryValueExW.ADVAPI32 ref: 00007FF71AC6D1BA
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0BDC1
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • ShellExecuteW.SHELL32 ref: 00007FF71AC0BE92
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF71AC0BEA0
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$Char_traitsDecorator::getErrorExecuteFileLastModuleNameOpenQueryShellTableTypeValuetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: $/init %ws /restart$eCode=%lu$open$product$reload_error
                                                                                                                                                                                      • API String ID: 1419841695-2650242239
                                                                                                                                                                                      • Opcode ID: baf7548c1ea7d3b87ecdc67accbb16a7ef7aa911b68b8ea32b86690c60975f49
                                                                                                                                                                                      • Instruction ID: 9b9fa6cfef632c0365b8e503c3292eb85da478cec8898abf1a314ed4395ca94d
                                                                                                                                                                                      • Opcode Fuzzy Hash: baf7548c1ea7d3b87ecdc67accbb16a7ef7aa911b68b8ea32b86690c60975f49
                                                                                                                                                                                      • Instruction Fuzzy Hash: D2B1D93250DEC2A1EA70AB14E8913EBF364FBC5350F805476D68D83B69EE6DD548CB50
                                                                                                                                                                                      Function 00007FF71AC6B720 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 174COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC6B7D0
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC6B801
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC6B939
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC6BAAE
                                                                                                                                                                                        • Part of subcall function 00007FF71AC11F30: char_traits.LIBCPMTD ref: 00007FF71AC11F50
                                                                                                                                                                                        • Part of subcall function 00007FF71AC11F30: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC11FA4
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC6BA06
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0E00: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF0E1D
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
                                                                                                                                                                                      • String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
                                                                                                                                                                                      • API String ID: 1744367693-4239264347
                                                                                                                                                                                      • Opcode ID: b2d4a3a5882bfcf986f1752a5fc00b982194c0c51f2aca48db01436fac4f58f5
                                                                                                                                                                                      • Instruction ID: 05f5d3db3f101f8d6b125c59e80b6dea52378ae8c794a1c5040ec0d9402e1091
                                                                                                                                                                                      • Opcode Fuzzy Hash: b2d4a3a5882bfcf986f1752a5fc00b982194c0c51f2aca48db01436fac4f58f5
                                                                                                                                                                                      • Instruction Fuzzy Hash: F991A43261DEC691EA70EB15E4913EAB3A0FBD5390F804176D68D42B6AEF3CD548CB50
                                                                                                                                                                                      Function 00007FF71AD960C0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 190registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: List$ClassCursorLoadRegister
                                                                                                                                                                                      • String ID: StartReplace
                                                                                                                                                                                      • API String ID: 1846139413-3907892786
                                                                                                                                                                                      • Opcode ID: 577b78836bfc545e7d593ebcd973cedbe8bc30b49b72b9c347ea66406f5f1fa8
                                                                                                                                                                                      • Instruction ID: 3450d5d89cc0159c6c898fb68640e9f368cbdbff9b310417e5b6464b602cde36
                                                                                                                                                                                      • Opcode Fuzzy Hash: 577b78836bfc545e7d593ebcd973cedbe8bc30b49b72b9c347ea66406f5f1fa8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9FA1E632609BC595EA71AB25E4507EAB7A4FBC8790F804072DA8D83B69DF3CD448CB50
                                                                                                                                                                                      Function 00007FF71AC59970 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CompatibleCreateObjectSelect$BitmapConcurrency::details::_DeleteSchedulerScheduler::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2453095338-3916222277
                                                                                                                                                                                      • Opcode ID: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
                                                                                                                                                                                      • Instruction ID: 59014ff6ee3250f138ada9a142491c3996409210591f44705ad819e2dea7634d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 35cec4d2eec9fa19ddf4e6ff6404fd960e49ea527ef232a0f76cb1028a1e667a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 49418636618B85C6EB60DF66E49439AF7A0F7C8790F504166EA8D83B69DF7CD448CB00
                                                                                                                                                                                      Function 00007FF71ABF6040 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 394windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • SHAppBarMessage.SHELL32 ref: 00007FF71ABF6288
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsDecorator::getMessageTableTypetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: product$start_button_not_created$startbutton_skip_win11_autohide_panel$system_panel_not_found
                                                                                                                                                                                      • API String ID: 2049050782-76959595
                                                                                                                                                                                      • Opcode ID: 71774a6460a3a2817b705b881c3b63fa15adc32b62b570dd849e99dac5bc4da3
                                                                                                                                                                                      • Instruction ID: 9141bb36e9631d88e720f98ac8696385619b10381755cb4f9a58b1be8641a63f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 71774a6460a3a2817b705b881c3b63fa15adc32b62b570dd849e99dac5bc4da3
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1822CB3261DEC6A1EA70EB14E8913EBB364FBC5350F805572D68D83B69EE2CD548CB10
                                                                                                                                                                                      Function 00007FF71AC55FB0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __crt_scoped_stack_ptrshared_ptr$ErrorInfoStringatomictask
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 442557458-0
                                                                                                                                                                                      • Opcode ID: eec43635d4d0d912bd5841557c7b9557d51348a900380df349c5f13bb5fc96cd
                                                                                                                                                                                      • Instruction ID: a69d4ff796ee5f9e679bc5bdc8b4fd8b46e11f3f62e762d0758153241a9dc0c8
                                                                                                                                                                                      • Opcode Fuzzy Hash: eec43635d4d0d912bd5841557c7b9557d51348a900380df349c5f13bb5fc96cd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 07711E22618E8181EA60EB55E4513BFE7B1FBD5790F804473F68D47BAADE2CD448CB60
                                                                                                                                                                                      Function 00007FF71AD97520 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 221COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: List$type_info::_name_internal_method$Char_traits
                                                                                                                                                                                      • String ID: Start$ToggleButton
                                                                                                                                                                                      • API String ID: 765240024-2452787978
                                                                                                                                                                                      • Opcode ID: 9ba1dbe52d4817c8325fb1d9f523f7bd2f6f20c5ee360e80093f246e5b70e27a
                                                                                                                                                                                      • Instruction ID: fbf5f56c29e489ad91eb1f1781ff955442e5c8e87e2ef338bd7ce19585f71997
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9ba1dbe52d4817c8325fb1d9f523f7bd2f6f20c5ee360e80093f246e5b70e27a
                                                                                                                                                                                      • Instruction Fuzzy Hash: E3B1E53260DBC686EA70EB15E4417AAB7A0FB85754F804172E6CD83BA9DF2CD549CB10
                                                                                                                                                                                      Function 00007FF71AC5BAD0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212registryCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72150: RegCreateKeyW.ADVAPI32 ref: 00007FF71AC7217A
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72150: RegDeleteValueW.ADVAPI32(?,?,?,?,?,?,?,?,00007FF71AC5BC9F), ref: 00007FF71AC721AB
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF71AC5BC9F), ref: 00007FF71AC721BA
                                                                                                                                                                                        • Part of subcall function 00007FF71AC72150: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00007FF71AC5BC9F), ref: 00007FF71AC721E6
                                                                                                                                                                                      • RegOpenKeyExW.ADVAPI32 ref: 00007FF71AC5BE1E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run, xrefs: 00007FF71AC5BB5A
                                                                                                                                                                                      • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF71AC5BAF3
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Close$Char_traitsCreateDeleteOpenValueshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run$Software\Microsoft\Windows\CurrentVersion\Run
                                                                                                                                                                                      • API String ID: 1230779726-377293507
                                                                                                                                                                                      • Opcode ID: c232ea3bc8f41e9fbb6286bb10383944cc682dd3a779634f73ea061d679c3877
                                                                                                                                                                                      • Instruction ID: 770c12468cab561803cfe05d86c7c1ee756db1c0b4b2737f1638441e140eed35
                                                                                                                                                                                      • Opcode Fuzzy Hash: c232ea3bc8f41e9fbb6286bb10383944cc682dd3a779634f73ea061d679c3877
                                                                                                                                                                                      • Instruction Fuzzy Hash: 56C1B632609FC195EAB0AB15F4503EBB7A4EBC9790F805126D6CD83B69DF2CC158CB10
                                                                                                                                                                                      Function 00007FF71AE232C8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF71AE23D14,?,?,?,?,00007FF71AE1A79D,?,?,?,?,00007FF71ADE13FC), ref: 00007FF71AE23444
                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF71AE23D14,?,?,?,?,00007FF71AE1A79D,?,?,?,?,00007FF71ADE13FC), ref: 00007FF71AE23450
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                      • Opcode ID: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
                                                                                                                                                                                      • Instruction ID: 1d047db3756d55b61647244e3c20041911c814f0bfdc859ea12830577e2afaa0
                                                                                                                                                                                      • Opcode Fuzzy Hash: b900d435430a5f103d2c1bdfa4f2820a536f3b69551882501559dce37074e2bd
                                                                                                                                                                                      • Instruction Fuzzy Hash: 08411621B19E0281FA26BB16A815577A395BF45BB0F85557BCD1D87780EF3CE80D8720
                                                                                                                                                                                      Function 00007FF71ADB8BE0 Relevance: 12.2, APIs: 8, Instructions: 233COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: allocator
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3447690668-0
                                                                                                                                                                                      • Opcode ID: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                      • Instruction ID: b5e91c41e41b751a7bc3ae7766a0e812b351c6393cf05777ebe9e97fb225e019
                                                                                                                                                                                      • Opcode Fuzzy Hash: 36a7d94fe0d72bb2d11dd43c1fe2a5c21703dc949e93bb453b0e81e27999111b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 58B14E2261DF8995EA709B16F08126FE3A0FB8A794F900176EACD47B5DDF3CC5448B10
                                                                                                                                                                                      Function 00007FF71AD9D580 Relevance: 12.2, APIs: 8, Instructions: 225COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkallocator
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1755220593-0
                                                                                                                                                                                      • Opcode ID: b463dd9d402667cf3ef89470c8f21a3e89c6157a2433209e970926fc6277b086
                                                                                                                                                                                      • Instruction ID: 33a0bf7a46f2d25a1a13d910841c522efd61088bc2a0f784fe8ebcd00ddbfdd4
                                                                                                                                                                                      • Opcode Fuzzy Hash: b463dd9d402667cf3ef89470c8f21a3e89c6157a2433209e970926fc6277b086
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9AB1DD2660CFC985EB70AB26E49036AB760FBC5B94F408066DECD47B5ADF2DD448CB50
                                                                                                                                                                                      Function 00007FF71AC4F7D0 Relevance: 11.0, APIs: 1, Strings: 5, Instructions: 488COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Func_class
                                                                                                                                                                                      • String ID: array$object$object key$object separator$value
                                                                                                                                                                                      • API String ID: 1670654298-2448007618
                                                                                                                                                                                      • Opcode ID: 17518177fa5bf14c63144c318cc4df87269cf1ac614ca5695af6caf8104aa4b8
                                                                                                                                                                                      • Instruction ID: 9a19b946210c845f653c73e3f8b1f510e101327d8cb36e6645f53364052a1260
                                                                                                                                                                                      • Opcode Fuzzy Hash: 17518177fa5bf14c63144c318cc4df87269cf1ac614ca5695af6caf8104aa4b8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5842F86660DFC185EAB0EB15E4902EEB3A4EBC5794F800176E6CD87B5ADF2CD548CB10
                                                                                                                                                                                      Function 00007FF71AC9FF90 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71ACA0161
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: /p.gif$ev.pcapp.store$pcdetails$process_add$process_delete
                                                                                                                                                                                      • API String ID: 3970144725-3242555254
                                                                                                                                                                                      • Opcode ID: c33289e9917a1a04138ae8731ef60cc161bd6cae6716e1d2d3b2224b49ce8ba9
                                                                                                                                                                                      • Instruction ID: 7383509ef5fc5390e0ce28f4c53078d2ca8f0c8832b3779689ee874dfff33f2d
                                                                                                                                                                                      • Opcode Fuzzy Hash: c33289e9917a1a04138ae8731ef60cc161bd6cae6716e1d2d3b2224b49ce8ba9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4351A13660AFC295EA70AB54F4813DAF3A4FBC5390F805526D68C82B69EF6CD548CB50
                                                                                                                                                                                      Function 00007FF71AE332D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                      • Opcode ID: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
                                                                                                                                                                                      • Instruction ID: 6dacb477603c3a9da53f6b30c377d4af90d7974843a263ea764c6864655635a5
                                                                                                                                                                                      • Opcode Fuzzy Hash: eddd2493575fffd36178473db237eee3d09d9d22ae17176b1e1a4d61f485cdc8
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2811A231A18E4182F750BB26E84572AA7A4FB88FF4F804276E95D87B94CF3CD44C8750
                                                                                                                                                                                      Function 00007FF71ADE7B88 Relevance: 9.2, APIs: 6, Instructions: 206COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharMultiStringWide
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2829165498-0
                                                                                                                                                                                      • Opcode ID: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
                                                                                                                                                                                      • Instruction ID: cb15da6a2d22629ffd18d96d919eb1fa0fc4faeab19e5230f0481da99144004e
                                                                                                                                                                                      • Opcode Fuzzy Hash: b6b862448baebf1a13a4e74f695d7dd3fded44265ae353c1136d9be3a601d1a2
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9B81D432A08F4686FB54AF219540279B2A5FF54BF4F850676EA9D53BD8DF3CD4088720
                                                                                                                                                                                      Function 00007FF71AC79C80 Relevance: 9.1, APIs: 6, Instructions: 135COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID:
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                      • Opcode ID: d704d9f6d4c914da91bb97a70124eaa907eccd68ffda45f1f6012a0ec4a8a684
                                                                                                                                                                                      • Instruction ID: f087c46354b87aea6e67440475ec01f71b97580e8aa3aa3a64b004fbe8087677
                                                                                                                                                                                      • Opcode Fuzzy Hash: d704d9f6d4c914da91bb97a70124eaa907eccd68ffda45f1f6012a0ec4a8a684
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1451621272DE5641FE90AB5AE49117AE360FBC0794FD41073FA8EC67E5DE2CE44A8720
                                                                                                                                                                                      Function 00007FF71AC871A0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 185COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Affinity::operator!=Concurrency::details::Hardware$Concurrency::details::_Min_valueSchedulerScheduler::_shared_ptr
                                                                                                                                                                                      • String ID: invalid hash bucket count
                                                                                                                                                                                      • API String ID: 122474871-1101463472
                                                                                                                                                                                      • Opcode ID: 2c13c2001e75f374a57d2876b0a09dfd13ed2be51a2a1c2dd3d113161dc8a856
                                                                                                                                                                                      • Instruction ID: 031304f59562969070d7777029cb6808a3e28311b60c41f5d729beb4281a5315
                                                                                                                                                                                      • Opcode Fuzzy Hash: 2c13c2001e75f374a57d2876b0a09dfd13ed2be51a2a1c2dd3d113161dc8a856
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D91FC2260DF8581EA60EF15F4912AAB360FBC4794F804076EACD47B6ADF2CD558CB50
                                                                                                                                                                                      Function 00007FF71AC8FD90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AC8FF13
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: pcdetails$spots$spots_list_is_empty$wlanspots
                                                                                                                                                                                      • API String ID: 3970144725-459635628
                                                                                                                                                                                      • Opcode ID: 0e9c4d45b85caac85cabfbc91d195ca10546917b60a05fa6c155878a70237626
                                                                                                                                                                                      • Instruction ID: b8394fab3cfd678b601c686d2542e595d19fe55f5e495e9c2c9cf2a88d150196
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e9c4d45b85caac85cabfbc91d195ca10546917b60a05fa6c155878a70237626
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8751C232619FC295EA70AB54F4813DAF3A4FBC5390F805526E68C83B69DF2CD548CB50
                                                                                                                                                                                      Function 00007FF71ABF5C60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ABF5DE3
                                                                                                                                                                                      • type_info::_name_internal_method.LIBCMTD ref: 00007FF71ABF5E15
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF5E22
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CCD0: ShellExecuteW.SHELL32 ref: 00007FF71AC9CD39
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CCD0: GetLastError.KERNEL32 ref: 00007FF71AC9CD4F
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptrtype_info::_name_internal_method$Char_traitsErrorExecuteLastShell
                                                                                                                                                                                      • String ID: ?guid=$https://pcapp.store/account/login
                                                                                                                                                                                      • API String ID: 4082085952-2754287439
                                                                                                                                                                                      • Opcode ID: 067ffa86449675d1b7ab6cab4f82ebcc9612916c6b46a5c6fd306857dc6d6dc5
                                                                                                                                                                                      • Instruction ID: eb4f5506fd5ae5e5ffdf84c0ed2da32c7cff19214f45e6b0fc5a10b4af967c80
                                                                                                                                                                                      • Opcode Fuzzy Hash: 067ffa86449675d1b7ab6cab4f82ebcc9612916c6b46a5c6fd306857dc6d6dc5
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7141C93261DFC291EA70AB54E4913EBE360FBC5390F805576E68D83B6ADE2CD548CB50
                                                                                                                                                                                      Function 00007FF71ABF5A50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MessagePost
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 410705778-3916222277
                                                                                                                                                                                      • Opcode ID: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
                                                                                                                                                                                      • Instruction ID: eaf0dd520d43d1d0917413301dc310250c071917d26f4cda98aca240e50bc08d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 7bee137265fb5014d2b543f6e157df9520fbe0187814ba912f6c14cf2ca86a50
                                                                                                                                                                                      • Instruction Fuzzy Hash: D2316432618B96C6F730AF65E45133AA390FB89791F900576F68D87B99CF3CD0198B10
                                                                                                                                                                                      Function 00007FF71AC4BBC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC4BC08
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC4BC26
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC4BC44
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC1BF40: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1BFC8
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC4BC65
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Exception$Destroy$Concurrency::details::EmptyFileHeaderQueue::RaiseStructuredWorkchar_traits
                                                                                                                                                                                      • String ID: type must be number, but is
                                                                                                                                                                                      • API String ID: 1470042880-1272216085
                                                                                                                                                                                      • Opcode ID: 8b39ff9f11193aed763a64e79f7bdbc0525becd687c1bcdccf8bf3d52f8b6cf1
                                                                                                                                                                                      • Instruction ID: b05fe28f1494153f440d9577dfcb2d80f12383d327553aff6459ed57c424ceb4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b39ff9f11193aed763a64e79f7bdbc0525becd687c1bcdccf8bf3d52f8b6cf1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F311A3650DE8285F670EF55E4913AEE760FBC47A4F8040B3E68E4766ACF2CD4498B24
                                                                                                                                                                                      Function 00007FF71AC240A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC240E8
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC24106
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC24124
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0F30: char_traits.LIBCPMTD ref: 00007FF71ABF0F5D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC1BF40: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1BFC8
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      • __ExceptionPtrDestroy.LIBCMTD ref: 00007FF71AC24144
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Exception$Destroy$Concurrency::details::EmptyFileHeaderQueue::RaiseStructuredWorkchar_traits
                                                                                                                                                                                      • String ID: type must be number, but is
                                                                                                                                                                                      • API String ID: 1470042880-1272216085
                                                                                                                                                                                      • Opcode ID: aa7e7621ec0cb0be2e331e12edbd3784bd4fcc7e2b85b9545d6c7af530bfc852
                                                                                                                                                                                      • Instruction ID: f58d423849d57bec59691ce1eac9e265233b358f98ecf5704282b71836faa14d
                                                                                                                                                                                      • Opcode Fuzzy Hash: aa7e7621ec0cb0be2e331e12edbd3784bd4fcc7e2b85b9545d6c7af530bfc852
                                                                                                                                                                                      • Instruction Fuzzy Hash: 59313C2650DE8282F670EF51E4503AEF760EBC4794F808073E68E436AADE2CD549CB20
                                                                                                                                                                                      Function 00007FF71AC03A40 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • std::make_error_code.LIBCPMTD ref: 00007FF71AC03AF8
                                                                                                                                                                                      • std::ios_base::failure::failure.LIBCPMTD ref: 00007FF71AC03B0A
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaisestd::ios_base::failure::failurestd::make_error_code
                                                                                                                                                                                      • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                                                                                                                                                                      • API String ID: 1846417002-1866435925
                                                                                                                                                                                      • Opcode ID: 0f62f35f85c9331fb493dc62c46e977a0797ab21aa6102782599f6169915fda0
                                                                                                                                                                                      • Instruction ID: c60ea04c52d4065deafc956ea5945cbe3a4449cc2590ec4f2920781e90f41b7d
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0f62f35f85c9331fb493dc62c46e977a0797ab21aa6102782599f6169915fda0
                                                                                                                                                                                      • Instruction Fuzzy Hash: E0212C36A1CA8286E770EF24E54126BB7A4F784354F944576E68DC3B99DF2CD50CCB10
                                                                                                                                                                                      Function 00007FF71AD9F8B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$FromMetricsMonitorPointSystem
                                                                                                                                                                                      • String ID: 0
                                                                                                                                                                                      • API String ID: 3043705201-4108050209
                                                                                                                                                                                      • Opcode ID: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
                                                                                                                                                                                      • Instruction ID: 8a01cf6c0a7ba8537061f90ebb36528fd02ae462e5239c97d9e3bfe7cf86ae7e
                                                                                                                                                                                      • Opcode Fuzzy Hash: b1cef08877c957b104a08cd9897fa60d020e7807a6ff63bc0b0519007cdeadc3
                                                                                                                                                                                      • Instruction Fuzzy Hash: DF11F1725086448BE725DF34E05521BFBB5F789794F50422AE78982B68DF7DD5888F00
                                                                                                                                                                                      Function 00007FF71AC2BBB0 Relevance: 7.7, APIs: 5, Instructions: 202COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: fpos
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1083263101-0
                                                                                                                                                                                      • Opcode ID: 29a01e6a9a3341e3bae9e12a73ce023ce4ac41a2dd13284b68cb0a05e65b8897
                                                                                                                                                                                      • Instruction ID: d2182cd8666f9d5d5cd5c5c393edf7644c7eeebd1966d0ba95967795b954bfc2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 29a01e6a9a3341e3bae9e12a73ce023ce4ac41a2dd13284b68cb0a05e65b8897
                                                                                                                                                                                      • Instruction Fuzzy Hash: 97A10A2260CFC585EA70AE15E45136AE7A0FBC57A4F540177EADE87B99CF2CE448CB10
                                                                                                                                                                                      Function 00007FF71AC15D70 Relevance: 7.7, APIs: 5, Instructions: 198COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_CriticalHandleLock::_Ptr_baseReentrantScoped_lockScoped_lock::~_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 831620384-0
                                                                                                                                                                                      • Opcode ID: af760f379ec04e9547c1160c26a1920e1fd47c3230e500d085326e158f7c885e
                                                                                                                                                                                      • Instruction ID: 716b8532f540696300d32d74d153a0c0d12c0b3365271c6abdf71479ecaf6c0f
                                                                                                                                                                                      • Opcode Fuzzy Hash: af760f379ec04e9547c1160c26a1920e1fd47c3230e500d085326e158f7c885e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9AA12A3260DEC691E670EB14E4913EBE360FBD4390F805172E69D87AAADF6CD548CB50
                                                                                                                                                                                      Function 00007FF71AC9C0C0 Relevance: 7.6, APIs: 5, Instructions: 102COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_CriticalHandleLock::_ReentrantScoped_lockScoped_lock::~_$Decorator::getTableType
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1823342465-0
                                                                                                                                                                                      • Opcode ID: f6fc702509c1399ee0d75592b459530a6c6a335c27b647294829118a81a6594a
                                                                                                                                                                                      • Instruction ID: 4298048cffdef9672014a8a2c0efc5bba0fef5268ff80ef02bc8d87669f6deda
                                                                                                                                                                                      • Opcode Fuzzy Hash: f6fc702509c1399ee0d75592b459530a6c6a335c27b647294829118a81a6594a
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0251F83250DEC285E670AB15E4503AFF7A4FBC4390F804076E6CD82BAAEF2CD5088B50
                                                                                                                                                                                      Function 00007FF71ABEBA40 Relevance: 7.6, APIs: 5, Instructions: 91COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: char_traits$Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_valuewmemset
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1140703174-0
                                                                                                                                                                                      • Opcode ID: f7c603095f74ec66db2225b11391a1da5a4235c41b6a324e3044bdd4d9b05956
                                                                                                                                                                                      • Instruction ID: b07f9e604f0422dc817b32878b41e216cd40d0199e575c5a6f155c1e6470f3e0
                                                                                                                                                                                      • Opcode Fuzzy Hash: f7c603095f74ec66db2225b11391a1da5a4235c41b6a324e3044bdd4d9b05956
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9D411B2661DF8682DA20EB25E08116EA7A0FBC9B94F501176EA8D43B69DE3CD5048B50
                                                                                                                                                                                      Function 00007FF71AC2D500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 147COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$Affinity::operator!=EmptyHardwareQueue::StructuredWorkshared_ptr
                                                                                                                                                                                      • String ID: /
                                                                                                                                                                                      • API String ID: 842898399-2043925204
                                                                                                                                                                                      • Opcode ID: 635186fc04129bc6fbba99cc46ce6d0e99de4f171f52b24813e71439d22450c9
                                                                                                                                                                                      • Instruction ID: 6f768629f9944b4fe8fdacb540a0038591c3654310e5c1aa41a98f75f235ec52
                                                                                                                                                                                      • Opcode Fuzzy Hash: 635186fc04129bc6fbba99cc46ce6d0e99de4f171f52b24813e71439d22450c9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C61302250CEC291EA71AB14E4902FEE760FBD9354FD04573E2CD82AAADE2CD54DCB10
                                                                                                                                                                                      Function 00007FF71AC1B620 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 140COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC1B8A9
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CB90: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 00007FF71AC9CBB7
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CB90: HandleT.LIBCPMTD ref: 00007FF71AC9CBC6
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CB90: std::ios_base::good.LIBCPMTD ref: 00007FF71AC9CC02
                                                                                                                                                                                        • Part of subcall function 00007FF71AC9CB90: std::ios_base::good.LIBCPMTD ref: 00007FF71AC9CC16
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$shared_ptr$std::ios_base::good$Char_traitsConcurrency::details::_CriticalDecorator::getHandleLock::_ReentrantScoped_lockScoped_lock::~_TableTypetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: /p.gif$bhist$ev.pcapp.store
                                                                                                                                                                                      • API String ID: 200462385-3993023549
                                                                                                                                                                                      • Opcode ID: e83fe781a59234aa164a9a7d4fa388bd3289e3f94a6b918668e5c670283cae35
                                                                                                                                                                                      • Instruction ID: 5ce669407fe7a0a17dcbfd23eae0cba7c32c6bc6351b00b27a9c17232fdb7877
                                                                                                                                                                                      • Opcode Fuzzy Hash: e83fe781a59234aa164a9a7d4fa388bd3289e3f94a6b918668e5c670283cae35
                                                                                                                                                                                      • Instruction Fuzzy Hash: 1971A43650DFC294EAB0AB14E8813DBB3A4FBC9350F805576D6CD83B69EE28D558CB50
                                                                                                                                                                                      Function 00007FF71AC83D50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 118COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC83E07
                                                                                                                                                                                      Strings
                                                                                                                                                                                      • d, xrefs: 00007FF71AC83E8E
                                                                                                                                                                                      • SELECT moz_places.url, moz_places.title, moz_places.visit_count, moz_historyvisits.visit_date/1000000 AS visit_time FROM moz_places JOIN moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id AND visit_time/1000000 > %d ORDER BY visit_time DESC, xrefs: 00007FF71AC83D8E
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID: SELECT moz_places.url, moz_places.title, moz_places.visit_count, moz_historyvisits.visit_date/1000000 AS visit_time FROM moz_places JOIN moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id AND visit_time/1000000 > %d ORDER BY visit_time DESC$d
                                                                                                                                                                                      • API String ID: 1865873047-3669390177
                                                                                                                                                                                      • Opcode ID: f2f33ef2a80301df11e05b3d2ba7cfa9c13836babcbe5b825c1a9b522fcf9067
                                                                                                                                                                                      • Instruction ID: 4e65f9c0addb261113753ac95842e429ccfe51f72c951e7e58867b767642b6ea
                                                                                                                                                                                      • Opcode Fuzzy Hash: f2f33ef2a80301df11e05b3d2ba7cfa9c13836babcbe5b825c1a9b522fcf9067
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2651EC3262DEC281E660EB15E4913EBE360FBD5790F905072E68D47AAADF3CD548CB50
                                                                                                                                                                                      Function 00007FF71AC938C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::_SchedulerScheduler::_
                                                                                                                                                                                      • String ID: notify_widget_click$product${"app": {"init": {"engineInit": true}}}
                                                                                                                                                                                      • API String ID: 2780765137-2196947271
                                                                                                                                                                                      • Opcode ID: 0cfedb95ce0267143f72ee36e2237f8b9c8b37b8b3191816c08451e7e16cddeb
                                                                                                                                                                                      • Instruction ID: 5ec1e825ecc4ec56c493fe1166ffc171c9199e754f5db60054286e76b22c7c26
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0cfedb95ce0267143f72ee36e2237f8b9c8b37b8b3191816c08451e7e16cddeb
                                                                                                                                                                                      • Instruction Fuzzy Hash: BA41E73261AE8291EA60AF14F4817DAF7A0FBC5790F805036E68D83B69DF7DD548CB50
                                                                                                                                                                                      Function 00007FF71AC0B220 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ADE1928: QueryPerformanceFrequency.KERNEL32(?,?,?,?,00007FF71AC0B231), ref: 00007FF71ADE193D
                                                                                                                                                                                        • Part of subcall function 00007FF71ADE190C: QueryPerformanceCounter.KERNEL32(?,?,?,?,00007FF71AC0B23B), ref: 00007FF71ADE1915
                                                                                                                                                                                      • _Subatomic.LIBCONCRTD ref: 00007FF71AC0B28E
                                                                                                                                                                                      • _Subatomic.LIBCONCRTD ref: 00007FF71AC0B32A
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: PerformanceQuerySubatomic$CounterFrequency
                                                                                                                                                                                      • String ID: d
                                                                                                                                                                                      • API String ID: 3831891851-2564639436
                                                                                                                                                                                      • Opcode ID: cd5766774a5e917e55ed93759baa310a6381a8aa9e51a2e88b1ad031a6da0d5f
                                                                                                                                                                                      • Instruction ID: 58d438fd461c3876761dd7a7e3452d5ddc5afb0b68d2d0fc6affd5b342759886
                                                                                                                                                                                      • Opcode Fuzzy Hash: cd5766774a5e917e55ed93759baa310a6381a8aa9e51a2e88b1ad031a6da0d5f
                                                                                                                                                                                      • Instruction Fuzzy Hash: EF31F522609B8581DA70DB19F8813AAF7A1F7C4794F505166E6CE47B69EF3CD1088F00
                                                                                                                                                                                      Function 00007FF71AC89560 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                      • String ID: 0$0
                                                                                                                                                                                      • API String ID: 2030045667-203156872
                                                                                                                                                                                      • Opcode ID: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
                                                                                                                                                                                      • Instruction ID: aae6e62dfb05b47289c0632deeba9ec8ece9696d198929f3f882d05f0c2b8c7e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6caa16854a35b4badb024bad1baed7d586a18f4617ca1ba13612c32c3a01b98f
                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F31FB36608B889ADB61DB15E45439BB7A5F7C87D0F804536EA8D83B68DF7CC648CB00
                                                                                                                                                                                      Function 00007FF71AC89410 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$MonitorRect$FromInfoWindow
                                                                                                                                                                                      • String ID: 0$0
                                                                                                                                                                                      • API String ID: 3203973389-203156872
                                                                                                                                                                                      • Opcode ID: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
                                                                                                                                                                                      • Instruction ID: 43686dc29112f42c7ece68ee5e5fc484e37f5c2d16ed8144923d587efe240af2
                                                                                                                                                                                      • Opcode Fuzzy Hash: bf1010573e3f3a245d3de0730b3cbbcce06f9b06f91d180bbfb8da37b1fbff6b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8731F036619B8886DB60DB55F49539AB7A5F7C8BD0F804026DB8D83B68DF7CC544CB10
                                                                                                                                                                                      Function 00007FF71AC71CD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                      • String ID: at line $, column
                                                                                                                                                                                      • API String ID: 2278334151-191570568
                                                                                                                                                                                      • Opcode ID: dc022c20d47e2cb9e8a1c392fdddab0337882a72ed377b2eedd2c77f924433b8
                                                                                                                                                                                      • Instruction ID: ea7c3ea6c226a4e0afb46392136112f207e387ee4ff36d866edc5072b7901ff3
                                                                                                                                                                                      • Opcode Fuzzy Hash: dc022c20d47e2cb9e8a1c392fdddab0337882a72ed377b2eedd2c77f924433b8
                                                                                                                                                                                      • Instruction Fuzzy Hash: AB31E23660DF8582EA60AB15F49129AF7A0F7C9790F404126EACD43B69DF3DD589CB40
                                                                                                                                                                                      Function 00007FF71AC891E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: MonitorRect$FromInfoWindow
                                                                                                                                                                                      • String ID: (
                                                                                                                                                                                      • API String ID: 2740140340-3887548279
                                                                                                                                                                                      • Opcode ID: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
                                                                                                                                                                                      • Instruction ID: 9e59a9e4eb90060bc3554e561025536db68e6590d9faf2cd35115931451b9825
                                                                                                                                                                                      • Opcode Fuzzy Hash: c0da5ba939e15d805878956d32222060a52adf0d43ead3bad2df4335e0b549e8
                                                                                                                                                                                      • Instruction Fuzzy Hash: F2F0EC36608A8496DA60EB14F84525AA764F7C8794F808531EACE83B28DF7CC549CB00
                                                                                                                                                                                      Function 00007FF71AE25FC4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                      • Opcode ID: 50da6c7cdd6b5d73a36253d486183ccfae61af487f813bce973e2a537128bc52
                                                                                                                                                                                      • Instruction ID: 4a89c3d63e3fb653275b32b149b7428029980038af53a78fd0418ba12e77b56a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 50da6c7cdd6b5d73a36253d486183ccfae61af487f813bce973e2a537128bc52
                                                                                                                                                                                      • Instruction Fuzzy Hash: F5D1E132B08A8189FB11EF65D4512ADB7A1FB447A8B84427BCE5D97B89DE38D40EC710
                                                                                                                                                                                      Function 00007FF71AC75C20 Relevance: 6.2, APIs: 4, Instructions: 245COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: swap
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 630424929-0
                                                                                                                                                                                      • Opcode ID: 34ce7f9225db79bbc210459c6b5e2f16bf786037060c5ec49b5396fcd4916ac1
                                                                                                                                                                                      • Instruction ID: 78bb00b440c823f21b456f1b2fab2c08322de71c52e525557ab3e7468b2c5bd3
                                                                                                                                                                                      • Opcode Fuzzy Hash: 34ce7f9225db79bbc210459c6b5e2f16bf786037060c5ec49b5396fcd4916ac1
                                                                                                                                                                                      • Instruction Fuzzy Hash: D8D10B2660EAC485FB70EB56E8507AEA760FBC5B94F404272DA8D47B5ACE3CC048CB54
                                                                                                                                                                                      Function 00007FF71AC17C00 Relevance: 6.2, APIs: 4, Instructions: 208COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC17C32
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC17DF3
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC17E08
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC0A97E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: _Max_value.LIBCPMTD ref: 00007FF71AC0A9A3
                                                                                                                                                                                        • Part of subcall function 00007FF71AC0A970: _Min_value.LIBCPMTD ref: 00007FF71AC0A9D1
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC17F47
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Max_valueMin_value
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 348937374-0
                                                                                                                                                                                      • Opcode ID: 39bc9ea6d7fddaceffdde3429ad3797e15c8df9c47615fe3e5980acb627e2537
                                                                                                                                                                                      • Instruction ID: f679f1325064ebe660615160dd52e02b0d9c0aa3cabf2668ae6a55466f86e63c
                                                                                                                                                                                      • Opcode Fuzzy Hash: 39bc9ea6d7fddaceffdde3429ad3797e15c8df9c47615fe3e5980acb627e2537
                                                                                                                                                                                      • Instruction Fuzzy Hash: 96B1E92660DFC585EA70EB16E4503ABE7A0F7C9B90F404176EACD83B6ADF2CD4448B50
                                                                                                                                                                                      Function 00007FF71AC2A090 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2155007778-0
                                                                                                                                                                                      • Opcode ID: 67e42fc80276c32ed0256da7e95af534a81ad04070bc67cdcdcdcbb85b244a4b
                                                                                                                                                                                      • Instruction ID: 1dd74e8673dfa6cfcfe3ec42914538086982e068f57b725eb25c178d257e03d8
                                                                                                                                                                                      • Opcode Fuzzy Hash: 67e42fc80276c32ed0256da7e95af534a81ad04070bc67cdcdcdcbb85b244a4b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9391D43660DAC585EA70AA15E4503EBA3A1F7C8790F804072EACD83BA9DF7CD549CB50
                                                                                                                                                                                      Function 00007FF71AC05590 Relevance: 6.2, APIs: 4, Instructions: 173COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2155007778-0
                                                                                                                                                                                      • Opcode ID: dedbae952985954632dfdf0ec9c88cbdcfdca269dec8da15e1d85c6607091e48
                                                                                                                                                                                      • Instruction ID: 9af76c517c46b817d365dd6b7043b4991a412ea914edb6149cc81ab5a0792ea7
                                                                                                                                                                                      • Opcode Fuzzy Hash: dedbae952985954632dfdf0ec9c88cbdcfdca269dec8da15e1d85c6607091e48
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9191D536609AC585EA70AB15E4503EBA3A0F7D8790F804072EACD83BA9DF7CD549CB50
                                                                                                                                                                                      Function 00007FF71AC29B00 Relevance: 6.1, APIs: 4, Instructions: 145COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkfrexplswprintf
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2911421839-0
                                                                                                                                                                                      • Opcode ID: edd66fc514574a58961c1f2b6052aadd014439acd1c4e242c25fd11f0a124995
                                                                                                                                                                                      • Instruction ID: d82b5d711b56a21ef78dc6b432e3f18aad5391d757b3b113610f19c740b65307
                                                                                                                                                                                      • Opcode Fuzzy Hash: edd66fc514574a58961c1f2b6052aadd014439acd1c4e242c25fd11f0a124995
                                                                                                                                                                                      • Instruction Fuzzy Hash: CA71283260DAC589E671AF25E4503EBFBA0EBC53A0F504176E6CD43A9ADE2CD548CF10
                                                                                                                                                                                      Function 00007FF71AC2BF50 Relevance: 6.1, APIs: 4, Instructions: 144COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: fpos
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1083263101-0
                                                                                                                                                                                      • Opcode ID: df175f4de71e66e6b5be73ffac7f5b6b237808cdf2cd3de5d06c119983bd8ab6
                                                                                                                                                                                      • Instruction ID: 83727476762d9a8b5ec179b014cf8c6abbacf60da7a6ce6d55df438b49d7cb28
                                                                                                                                                                                      • Opcode Fuzzy Hash: df175f4de71e66e6b5be73ffac7f5b6b237808cdf2cd3de5d06c119983bd8ab6
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2E61003291CA8186F660AB59E44136AE7A0FBC47A4F540273FADD87BA9CF2CD444CF50
                                                                                                                                                                                      Function 00007FF71AC09DD0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF71AC09DFD
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39190
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWorkshared_ptr$Char_traitsDecorator::getErrorLastTableTypetype_info::_name_internal_method
                                                                                                                                                                                      • String ID: eCode=%lu$product$taskbar_handler_error
                                                                                                                                                                                      • API String ID: 2217433456-2493891406
                                                                                                                                                                                      • Opcode ID: f84f2fa440caa1153294f8e07e19e60bbf64c3ad748222ee8e89cb494fe0bf19
                                                                                                                                                                                      • Instruction ID: d3d9112a2329512b9c8de15b50f395b661ccb9872b6d17cdc24821c19105ea93
                                                                                                                                                                                      • Opcode Fuzzy Hash: f84f2fa440caa1153294f8e07e19e60bbf64c3ad748222ee8e89cb494fe0bf19
                                                                                                                                                                                      • Instruction Fuzzy Hash: A461E93260DEC2A1EA70AB14E8913EBF364FBC5350F805476D68D83B69EE6CD549CB10
                                                                                                                                                                                      Function 00007FF71AC80080 Relevance: 6.1, APIs: 4, Instructions: 77COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __std_fs_convert_wide_to_narrow$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 3856960188-0
                                                                                                                                                                                      • Opcode ID: 4157f68cdb56d6d25ae8bc928bb773fbd150dc22e8f81d30abe7ed3d1957b054
                                                                                                                                                                                      • Instruction ID: cb1d2eea279cd28d33a9d24965c4317a6df958435bb5309ecf2464d4a019a0b4
                                                                                                                                                                                      • Opcode Fuzzy Hash: 4157f68cdb56d6d25ae8bc928bb773fbd150dc22e8f81d30abe7ed3d1957b054
                                                                                                                                                                                      • Instruction Fuzzy Hash: 0631E832619A8186E660EF15E4913ABF7A1FBD5790F801076F6CE47A6ADF3CD4088F50
                                                                                                                                                                                      Function 00007FF71AC79A70 Relevance: 6.1, APIs: 4, Instructions: 76COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: __std_fs_convert_narrow_to_wide$Concurrency::details::EmptyListQueue::StructuredWorkstd::make_error_code
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 108412505-0
                                                                                                                                                                                      • Opcode ID: 0f3526c0e4bd492f6ad4b32a8ec4969392296dfbebe739b2393f3b29a8fe67b3
                                                                                                                                                                                      • Instruction ID: 3ca9d12868428fcb424560a3df3cc5777d288078207582fd0cd03b47b2f21238
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0f3526c0e4bd492f6ad4b32a8ec4969392296dfbebe739b2393f3b29a8fe67b3
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9931EB32619A8185E660EB55F4913ABF7A0FBC5790F401076F6CE87B6ADF3CD4088B50
                                                                                                                                                                                      Function 00007FF71ABEFFC0 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 228209623-0
                                                                                                                                                                                      • Opcode ID: 8249a4ac4d7d0727df311331541a855cc94a4cb790273433456665f2fb1e2247
                                                                                                                                                                                      • Instruction ID: 85ec49a8aa5e8c664b10a60555c9068a02529f4180b8b6132ae8463976073e04
                                                                                                                                                                                      • Opcode Fuzzy Hash: 8249a4ac4d7d0727df311331541a855cc94a4cb790273433456665f2fb1e2247
                                                                                                                                                                                      • Instruction Fuzzy Hash: 9821122651CF8681EA60AB24E48116AF764FBD47B4F941272F68E43BB9DE3CD548CB10
                                                                                                                                                                                      Function 00007FF71ABF00D0 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 228209623-0
                                                                                                                                                                                      • Opcode ID: 9e4c830939a2f39160d9f03ecd364129dee5c4ba46132c2e25f2321b50e46cd1
                                                                                                                                                                                      • Instruction ID: e00c0290c6a9acfc93927077d751b081bb811980c472b9730a1287f25c1735ee
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9e4c830939a2f39160d9f03ecd364129dee5c4ba46132c2e25f2321b50e46cd1
                                                                                                                                                                                      • Instruction Fuzzy Hash: 26213E2651CF8681EA60AB14E48116AF7A4FB947B4F941272F68E03BB9DF3CD558CB10
                                                                                                                                                                                      Function 00007FF71AC53170 Relevance: 6.1, APIs: 4, Instructions: 59COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Getfacetstd::locale::_
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 228209623-0
                                                                                                                                                                                      • Opcode ID: bb41a2f06be89dc3d26360acdb6af9d6519e60d92c6322cb048032e2da2ee97b
                                                                                                                                                                                      • Instruction ID: a2fad43c96a26c8a8413563da0e6ebfa9f381171ecec7d4172d6be5d134256e7
                                                                                                                                                                                      • Opcode Fuzzy Hash: bb41a2f06be89dc3d26360acdb6af9d6519e60d92c6322cb048032e2da2ee97b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D21102661CF4581EA60EB14E49126AF7A0FBD47B4F901272F69E43BA9CE3CD558CB10
                                                                                                                                                                                      Function 00007FF71ADE74EC Relevance: 6.1, APIs: 4, Instructions: 53COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 203985260-0
                                                                                                                                                                                      • Opcode ID: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
                                                                                                                                                                                      • Instruction ID: 431b4f4516baab59a41fcb9639b2280c89d4c6e54e3f3f870b0b16695e7d6db3
                                                                                                                                                                                      • Opcode Fuzzy Hash: bee03ca3288017b3369f8dcb09f862a3064febdc74deef89483fb6043f1d9de6
                                                                                                                                                                                      • Instruction Fuzzy Hash: B0214C72A18F8586F7509F22E44431EBBB4F798B90F54017ADB8997B58DF3CD4098B10
                                                                                                                                                                                      Function 00007FF71AC01B60 Relevance: 6.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Func_class
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1670654298-0
                                                                                                                                                                                      • Opcode ID: bd01bd58726bd3f0c66db9246e0ea83f485c70cc4ec0d51cd3e4b8a36031a15c
                                                                                                                                                                                      • Instruction ID: cb856bfafc57559f679a240e37c5ac56284d5897e8f11ddaefa701ab7b7c5520
                                                                                                                                                                                      • Opcode Fuzzy Hash: bd01bd58726bd3f0c66db9246e0ea83f485c70cc4ec0d51cd3e4b8a36031a15c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5311E826A0CE4584EA10BF16E94102AE7B1FBC9BE0F904076EB8D8776ADE2CD4558B10
                                                                                                                                                                                      Function 00007FF71AE03594 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                      • Opcode ID: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
                                                                                                                                                                                      • Instruction ID: 62008f295c7f33741a24cbe4994a98e98021c93aaee907ae88a8cbaa73804bbc
                                                                                                                                                                                      • Opcode Fuzzy Hash: c71fb8e88b71c372db582b079ead3d4d3277890d777de073fadcf7bcbc0d32b8
                                                                                                                                                                                      • Instruction Fuzzy Hash: B5114C36B14F058AFB00EF70E8552AA73A4F758B68F840E32DA2D827A4DF78D15C8350
                                                                                                                                                                                      Function 00007FF71AC21850 Relevance: 6.0, APIs: 4, Instructions: 33windowCOMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Message$BeginConcurrency::details::_DispatchInitInitializeOncePeekSchedulerScheduler::_Translate
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1659482951-0
                                                                                                                                                                                      • Opcode ID: 46343ae8780c4d654fa3ec0113a3b23bbcc3f883197a57aab6ad381d8c83bebf
                                                                                                                                                                                      • Instruction ID: 89a4f840fd5bb8951c6f07cc169e3abb88c24ce3db9305c25e91cf304f150552
                                                                                                                                                                                      • Opcode Fuzzy Hash: 46343ae8780c4d654fa3ec0113a3b23bbcc3f883197a57aab6ad381d8c83bebf
                                                                                                                                                                                      • Instruction Fuzzy Hash: A9011636618F8281FB50AF25E48176BB770FBC5790F909076E68E83A65DF2CD44D8B10
                                                                                                                                                                                      Function 00007FF71ACABCF0 Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ACABD1B
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ACABD2A
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ACABD4B
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ACABD55
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1865873047-0
                                                                                                                                                                                      • Opcode ID: 3233295b20d291cbbdb429da83de8f43e4d43eb9944099a1be368375c9ef5e0b
                                                                                                                                                                                      • Instruction ID: 47632ba4ae7c774342af15d4261e9901df4afd46a6ab08c8649485a86a147bc5
                                                                                                                                                                                      • Opcode Fuzzy Hash: 3233295b20d291cbbdb429da83de8f43e4d43eb9944099a1be368375c9ef5e0b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 36016B6291CEC181E620FB55E45116FE760FBC4BA4F400573FA8D87B6ADFACD4548B50
                                                                                                                                                                                      Function 00007FF71AC25980 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC259AB
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC259BA
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC259D3
                                                                                                                                                                                      • Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC259DD
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork
                                                                                                                                                                                      • String ID:
                                                                                                                                                                                      • API String ID: 1865873047-0
                                                                                                                                                                                      • Opcode ID: 0162076176430ab22fa6d18088bb7c5fa26ba75fb539a11a53f633b1ca86fbc0
                                                                                                                                                                                      • Instruction ID: 9ccd05828e483cbc24907accba1455c55bb78819bc618b7cdd52c7f787d29b68
                                                                                                                                                                                      • Opcode Fuzzy Hash: 0162076176430ab22fa6d18088bb7c5fa26ba75fb539a11a53f633b1ca86fbc0
                                                                                                                                                                                      • Instruction Fuzzy Hash: B601972291CD8681EA20FB25E45106BA770FBC5790F604473EB8D87B6ACF2DD8558B50
                                                                                                                                                                                      Function 00007FF71AC276A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Mpunctstd::ios_base::width
                                                                                                                                                                                      • String ID: @
                                                                                                                                                                                      • API String ID: 1954291571-2766056989
                                                                                                                                                                                      • Opcode ID: dd89c21f3644dc9b8166415bda9e88d37b4f3a0384955dc7af636263327da036
                                                                                                                                                                                      • Instruction ID: 62ac62e28ae307599331a2b7d983ddda33392e3e02cd8940a12e0742640a63fd
                                                                                                                                                                                      • Opcode Fuzzy Hash: dd89c21f3644dc9b8166415bda9e88d37b4f3a0384955dc7af636263327da036
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B02F33260DEC585EA70AB15E8943ABA7A1F7C8790F840172DA8D83B69DF7CD549CB40
                                                                                                                                                                                      Function 00007FF71AC6D8D0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 314COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: CreateInstance
                                                                                                                                                                                      • String ID: Shell_TrayWnd
                                                                                                                                                                                      • API String ID: 542301482-2988720461
                                                                                                                                                                                      • Opcode ID: a93b6b14809aef4c78c6aafc3cc1ba4a41bb7092c0f8f7cdce8afc8a31f7a40b
                                                                                                                                                                                      • Instruction ID: d19a83129f1b9328ddc63fe4f34b35af2499a93159fa0e4aa352d8011bf7fe48
                                                                                                                                                                                      • Opcode Fuzzy Hash: a93b6b14809aef4c78c6aafc3cc1ba4a41bb7092c0f8f7cdce8afc8a31f7a40b
                                                                                                                                                                                      • Instruction Fuzzy Hash: 28E1CA3260DEC595EA70EB15E8903EAE360FBD4750F804172E68D83BAADF2CD549CB50
                                                                                                                                                                                      Function 00007FF71ABE71B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 243COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ABE76B9
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                      • String ID: $@
                                                                                                                                                                                      • API String ID: 3399187363-1077428164
                                                                                                                                                                                      • Opcode ID: 1e046f260e677a714644b96302eafbe6aed11fa634032abd8b7550bd551f1b3c
                                                                                                                                                                                      • Instruction ID: 205771a78c7604e8f4358ab34c87366eb72533d51019db532f961ba1a62e5a68
                                                                                                                                                                                      • Opcode Fuzzy Hash: 1e046f260e677a714644b96302eafbe6aed11fa634032abd8b7550bd551f1b3c
                                                                                                                                                                                      • Instruction Fuzzy Hash: 51D1B332649FC695EAB0AB14F8903DAB3A4FBC9750F805126D68C83B69DF39C558CB50
                                                                                                                                                                                      Function 00007FF71ABE1BB1 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ABE2059
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                      • String ID: $@
                                                                                                                                                                                      • API String ID: 3399187363-1077428164
                                                                                                                                                                                      • Opcode ID: ab9aa1e139365ff1342ad5d536146f3cfd1fa2837734d7442fb810ee2aa17e8e
                                                                                                                                                                                      • Instruction ID: 0aef9cb95dbd155c10754d10b7bd4dc6ec5979e126d677f96d6864115277f932
                                                                                                                                                                                      • Opcode Fuzzy Hash: ab9aa1e139365ff1342ad5d536146f3cfd1fa2837734d7442fb810ee2aa17e8e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 6DD1B33254DFC694EAB0AB14F4903DAB3A4FBC9750F805126D6CC82B69DF39D558CB50
                                                                                                                                                                                      Function 00007FF71ABE3D00 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ABE4179
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                      • String ID: $@
                                                                                                                                                                                      • API String ID: 3399187363-1077428164
                                                                                                                                                                                      • Opcode ID: e552e707bedc727bb4a8cd7551db7ab6c8cf7959fc1fb0c5acdbbe606d4d72ca
                                                                                                                                                                                      • Instruction ID: 2a9c8268151147db49c0d79f340f8e5e3469bdcf014d82cfb741714239ab186a
                                                                                                                                                                                      • Opcode Fuzzy Hash: e552e707bedc727bb4a8cd7551db7ab6c8cf7959fc1fb0c5acdbbe606d4d72ca
                                                                                                                                                                                      • Instruction Fuzzy Hash: E0C1B232649EC6A1EA71AB14E4913DBB364FB89350F805136D6CD83BA9DF3CC549CB50
                                                                                                                                                                                      Function 00007FF71ABE5300 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ABE5779
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                      • String ID: $@
                                                                                                                                                                                      • API String ID: 3399187363-1077428164
                                                                                                                                                                                      • Opcode ID: 74c198e2835fdce05dc510e2191a2729030ed8b379356ea5260cfd2e37f6dcb3
                                                                                                                                                                                      • Instruction ID: 8d52042b939ed0755913b7f6e4471340f6cc51f78c089b96b7331b9862ad021f
                                                                                                                                                                                      • Opcode Fuzzy Hash: 74c198e2835fdce05dc510e2191a2729030ed8b379356ea5260cfd2e37f6dcb3
                                                                                                                                                                                      • Instruction Fuzzy Hash: 71C1A132609EC6A1EA71EB14E4913DBB3A4FB89350F805136D6CD83BA9DF38D549CB50
                                                                                                                                                                                      Function 00007FF71ABE77A0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 225COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • std::_Fac_node::_Fac_node.LIBCPMTD ref: 00007FF71ABE7C19
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyFac_nodeFac_node::_Queue::StructuredWorkstd::_
                                                                                                                                                                                      • String ID: $@
                                                                                                                                                                                      • API String ID: 3399187363-1077428164
                                                                                                                                                                                      • Opcode ID: 884cf000fea2aa66f915d0871b8cf4dd4e5ceb8d1f068f952f2ead92e703f8a9
                                                                                                                                                                                      • Instruction ID: c8228f12cfebe65904d87b2ef76e4fac778eb035ff67472510fab04d3f16f07a
                                                                                                                                                                                      • Opcode Fuzzy Hash: 884cf000fea2aa66f915d0871b8cf4dd4e5ceb8d1f068f952f2ead92e703f8a9
                                                                                                                                                                                      • Instruction Fuzzy Hash: 8DC1B132609EC6A5EA71AB14F4913EBB364FB89350F805136D6CD43BA9DF38C549CB50
                                                                                                                                                                                      Function 00007FF71AC4F845 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::cancellation_token::_FromImpl
                                                                                                                                                                                      • String ID: object key$object separator
                                                                                                                                                                                      • API String ID: 2278334151-2279923633
                                                                                                                                                                                      • Opcode ID: 6d454f74ac45d6ccd4501eb20f0ac82e94d3955d60955d5f3c4cb3b5a886e362
                                                                                                                                                                                      • Instruction ID: a51e8ceafce043b35194c2b744c7300ea182ff4284a65c8a934f4ace102e0d7e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 6d454f74ac45d6ccd4501eb20f0ac82e94d3955d60955d5f3c4cb3b5a886e362
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4EB1DA6260DEC284EA70EB15E4513EEB3A1EB85794F804173E6CD87B9ADF2CD548CB50
                                                                                                                                                                                      Function 00007FF71ADA2020 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F05
                                                                                                                                                                                        • Part of subcall function 00007FF71AC38E90: shared_ptr.LIBCMTD ref: 00007FF71AC38F8E
                                                                                                                                                                                      • std::bad_exception::bad_exception.LIBCMTD ref: 00007FF71ADA2288
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                        • Part of subcall function 00007FF71AE03DA0: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: shared_ptr$Concurrency::details::EmptyQueue::StructuredWork$Char_traitsExceptionFileHeaderRaisestd::bad_exception::bad_exceptiontype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Memory allocation error
                                                                                                                                                                                      • API String ID: 3813484266-4275684249
                                                                                                                                                                                      • Opcode ID: 72d3b6a7ad973a51b4cd3b28f11063e7c9b48f384615a15f396a1fa2279e7ef7
                                                                                                                                                                                      • Instruction ID: a70fd0e4f981227085ca1a9aa6a56cb26e51dfc0c86def0ed84d1607c41b342e
                                                                                                                                                                                      • Opcode Fuzzy Hash: 72d3b6a7ad973a51b4cd3b28f11063e7c9b48f384615a15f396a1fa2279e7ef7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4261CC3661AFC595EAB0EB15E4853AAB3A0FBC4750F808076D68D43B69DF3CD449CB50
                                                                                                                                                                                      Function 00007FF71AE27CF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                      • Opcode ID: 9dbb3c9588a2d576a7b6a8a75f854b0947bec1d77bf889753753a878ff851ffc
                                                                                                                                                                                      • Instruction ID: 1a2676001b0cabbc50db77139c06c42ba9cfaaa036c76c9d2f2bc56413354ddd
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9dbb3c9588a2d576a7b6a8a75f854b0947bec1d77bf889753753a878ff851ffc
                                                                                                                                                                                      • Instruction Fuzzy Hash: 99412712A08B8242FB20BB25941237BE650EF81BB4F90427FEE5C06AD5DF3CD88D8710
                                                                                                                                                                                      Function 00007FF71AC10070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9F8B0: SHAppBarMessage.SHELL32 ref: 00007FF71AD9F8FD
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9F8B0: GetSystemMetrics.USER32 ref: 00007FF71AD9F915
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9F8B0: SHAppBarMessage.SHELL32 ref: 00007FF71AD9F939
                                                                                                                                                                                        • Part of subcall function 00007FF71AD9F8B0: SHAppBarMessage.SHELL32 ref: 00007FF71AD9F959
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF10B0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71ABF10CD
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AC101D2
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF0510: UnDecorator::getVbTableType.LIBCMTD ref: 00007FF71ABF0551
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyMessageQueue::StructuredWork$Char_traitsConcurrency::details::_Decorator::getMetricsSchedulerScheduler::_SystemTableTypeshared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: Topbar${"app" : {"show_window":"topbar"}}
                                                                                                                                                                                      • API String ID: 10853918-1514018050
                                                                                                                                                                                      • Opcode ID: 493f034b9b27803a8c8c45acc609e63e556de46a9ab7dd9215f9147c48b565b7
                                                                                                                                                                                      • Instruction ID: f1648ad0d80c0823963b8de6c7aaf322820373b2512c3a11b196eb03dd173e3b
                                                                                                                                                                                      • Opcode Fuzzy Hash: 493f034b9b27803a8c8c45acc609e63e556de46a9ab7dd9215f9147c48b565b7
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E41C432619FC591EA70AB15E4913DBB3A4FBC5790F804136EA8D43B6ADE3CD548CB50
                                                                                                                                                                                      Function 00007FF71AC99BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71ABF11A0: _WChar_traits.LIBCPMTD ref: 00007FF71ABF11CD
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: type_info::_name_internal_method.LIBCMTD ref: 00007FF71AC39930
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC3995D
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: shared_ptr.LIBCMTD ref: 00007FF71AC39993
                                                                                                                                                                                        • Part of subcall function 00007FF71AC398A0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 00007FF71AC39A2E
                                                                                                                                                                                      • Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FF71AC99C6E
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::EmptyQueue::StructuredWork$Char_traitsConcurrency::details::_SchedulerScheduler::_shared_ptrtype_info::_name_internal_method
                                                                                                                                                                                      • String ID: printer_paper$printer_toner
                                                                                                                                                                                      • API String ID: 3970144725-2138351318
                                                                                                                                                                                      • Opcode ID: 9a613b81221aa6a76e23a6e6a509f6835bbfe9a02de487bc06592ad6e23ce32e
                                                                                                                                                                                      • Instruction ID: 58696a75f5fbcdea4d6b298f72d7301bea9c13c2702d0c0a076bfedc305c8234
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a613b81221aa6a76e23a6e6a509f6835bbfe9a02de487bc06592ad6e23ce32e
                                                                                                                                                                                      • Instruction Fuzzy Hash: 5031C436619F82A2EA60EB54F49129BF760FBC5390F805026E68D83A69DF3CD549CB50
                                                                                                                                                                                      Function 00007FF71AC4722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: Concurrency::details::$Affinity::operator!=Hardwareshared_ptr$EmptyQueue::StructuredWorktype_info::_name_internal_method
                                                                                                                                                                                      • String ID: 0123456789ABCDEFabcdef-+Xx
                                                                                                                                                                                      • API String ID: 947352594-2799312399
                                                                                                                                                                                      • Opcode ID: 9206f079de26dfaf4d29c21f41c140430604b0fe994b2d3f15df50169aa253dc
                                                                                                                                                                                      • Instruction ID: a761a8795b1e36aef04e949c02e3c793951c587cb17ab8df55328a16ab840e47
                                                                                                                                                                                      • Opcode Fuzzy Hash: 9206f079de26dfaf4d29c21f41c140430604b0fe994b2d3f15df50169aa253dc
                                                                                                                                                                                      • Instruction Fuzzy Hash: AF21213250DEC184EA61AF15E4801BEBBA1E7C4790F940073FA8E87B69DE2CD049CB54
                                                                                                                                                                                      Function 00007FF71AE03DA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                      • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03DF0
                                                                                                                                                                                      • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF71AC0227F), ref: 00007FF71AE03E31
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                      • Opcode ID: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
                                                                                                                                                                                      • Instruction ID: 69f3af3db84c4211b300b7c7126782d66633256b268ca5e95fc392ab16563bfe
                                                                                                                                                                                      • Opcode Fuzzy Hash: 292631c76c28477b0b341e5100f2c649277cad9beabe8196f62ee79e546b0a13
                                                                                                                                                                                      • Instruction Fuzzy Hash: 4B115E32618F4582EB20AF25E50025AB7E5FB88B94F984271DE8C47758DF3CC559CB00
                                                                                                                                                                                      Function 00007FF71AC6F300 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                      APIs
                                                                                                                                                                                        • Part of subcall function 00007FF71AC720D0: shared_ptr.LIBCMTD ref: 00007FF71AC720DE
                                                                                                                                                                                      • GetErrorInfo.OLEAUT32(?,?,?,?,?,?,00007FF71AC56250), ref: 00007FF71AC6F372
                                                                                                                                                                                        • Part of subcall function 00007FF71AC52B90: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FF71AC52BCA
                                                                                                                                                                                      Strings
                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                      • Source File: 0000000A.00000002.3215261326.00007FF71ABE1000.00000020.00000001.01000000.00000016.sdmp, Offset: 00007FF71ABE0000, based on PE: true
                                                                                                                                                                                      • Associated: 0000000A.00000002.3213410944.00007FF71ABE0000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3233552193.00007FF71AE4B000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3236889591.00007FF71AE92000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3238628547.00007FF71AE93000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3241386466.00007FF71AEA8000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3243470614.00007FF71AEAA000.00000008.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEAF000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3245207939.00007FF71AEB9000.00000004.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      • Associated: 0000000A.00000002.3248822227.00007FF71AEBC000.00000002.00000001.01000000.00000016.sdmpDownload File
                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                      • Snapshot File: hcaresult_10_2_7ff71abe0000_PcAppStore.jbxd
                                                                                                                                                                                      Similarity
                                                                                                                                                                                      • API ID: ErrorInfo__crt_scoped_stack_ptrshared_ptr
                                                                                                                                                                                      • String ID: RoOriginateLanguageException$combase.dll
                                                                                                                                                                                      • API String ID: 1999312203-3996158991
                                                                                                                                                                                      • Opcode ID: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
                                                                                                                                                                                      • Instruction ID: c4a22d740904fc857310cd50505fa0d5edb1fa3e73fd5730291329b2c1f68be2
                                                                                                                                                                                      • Opcode Fuzzy Hash: 23039f19f1820bb7f7476837f36a12bc1ccd444b90eeaabbed9ce580c32f9450
                                                                                                                                                                                      • Instruction Fuzzy Hash: EE013C62A18E4281FA10FF24E4560ABE771FB943A4FC04573F58D026AADE3CD20CCB50